theory Tcb_C

lemma decodeTCBConfigure_ccorres:
  notes tl_drop_1[simp] scast_mask_8 [simp]
  shows
  "interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow>
   ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and sch_act_simple
              and (\<lambda>s. ksCurThread s = thread) and ct_active'
              and (excaps_in_mem extraCaps o ctes_of)
              and valid_cap' cp and cte_at' slot and K (isThreadCap cp)
              and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             s \<turnstile>' fst v \<and> cte_at' (snd v) s)
              and (\<lambda>s. \<forall>v \<in> set extraCaps.
                             ex_cte_cap_wp_to' isCNodeCap (snd v) s)
              and sysargs_rel args buffer)
       (UNIV
            \<inter> {s. ccap_relation cp (cap_' s)}
            \<inter> {s. unat (length___unsigned_long_' s) = length args}
            \<inter> {s. slot_' s = cte_Ptr slot}
            \<inter> {s. current_extra_caps_' (globals s) = extraCaps'}
            \<inter> {s. buffer_' s = option_to_ptr buffer}) []
     (decodeTCBConfigure args cp slot extraCaps
            >>= invocationCatch thread isBlocking isCall InvokeTCB)
     (Call decodeTCBConfigure_'proc)" apply (cinit' lift: cap_' length___unsigned_long_' slot_' current_extra_caps_' buffer_'
                simp: decodeTCBConfigure_def) apply csymbr apply (clarsimp cong: StateSpace.state.fold_congs globals.fold_congs
               simp del: Collect_const
               simp add: interpret_excaps_test_null2 excaps_map_Nil) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_cond_true_seq | simp)+ apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0 word_less_nat_alt) apply (clarsimp split: list.split
                     simp: throwError_def invocationCatch_def fst_return
                           intr_and_se_rel_def
                           Collect_const_mem syscall_error_rel_def
                           exception_defs syscall_error_to_H_cases) apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_cond_true_seq | simp)+ apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0 word_less_nat_alt) apply (clarsimp split: list.split
                     simp: throwError_def invocationCatch_def fst_return
                           intr_and_se_rel_def
                           Collect_const_mem syscall_error_rel_def
                           exception_defs syscall_error_to_H_cases) apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_cond_true_seq | simp)+ apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0 word_less_nat_alt) apply (clarsimp split: list.split
                     simp: throwError_def invocationCatch_def fst_return
                           intr_and_se_rel_def excaps_map_def
                           Collect_const_mem syscall_error_rel_def
                           exception_defs syscall_error_to_H_cases) apply csymbr apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_cond_true_seq | simp)+ apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0 word_less_nat_alt) apply (clarsimp split: list.split
                     simp: throwError_def invocationCatch_def fst_return
                           intr_and_se_rel_def excaps_map_def
                           Collect_const_mem syscall_error_rel_def
                           exception_defs syscall_error_to_H_cases) apply (simp add: if_1_0_0 word_less_nat_alt linorder_not_less
               del: Collect_const) apply (rename_tac length' cap') apply (subgoal_tac "length extraCaps \<ge> 3") prefer 2 apply (clarsimp simp: idButNot_def interpret_excaps_test_null
                          excaps_map_def neq_Nil_conv) apply (thin_tac "P \<longrightarrow> index exc n \<noteq> NULL" for P exc n)+ apply (rule_tac P="\<lambda>a. ccorres rvr xf P P' hs a c" for rvr xf P P' hs c in ssubst,
          rule bind_cong [OF _ refl], rule list_case_helper, clarsimp)+ apply (simp add: hd_drop_conv_nth2 del: Collect_const) apply (rule ccorres_add_return,
          ctac add: getSyscallArg_ccorres_foo[where args=args and n=0 and buffer=buffer]) apply (rule ccorres_add_return,
            ctac add: getSyscallArg_ccorres_foo'[where args=args and n=1 and buffer=buffer]) apply (rule ccorres_add_return,
              ctac add: getSyscallArg_ccorres_foo[where args=args and n=2 and buffer=buffer]) apply (rule ccorres_add_return,
                ctac add: getSyscallArg_ccorres_foo[where args=args and n=3 and buffer=buffer]) apply csymbr apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=0]) apply (rule ccorres_move_c_guard_cte) apply ctac apply (rule ccorres_assert2) apply csymbr apply (rule ccorres_move_c_guard_cte) apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=1]) apply ctac apply (rule ccorres_assert2) apply csymbr apply (rule getSlotCap_ccorres_fudge_n[where vals=extraCaps and n=2]) apply (rule ccorres_move_c_guard_cte) apply ctac apply (rule ccorres_assert2) apply (simp add: decodeSetIPCBuffer_def split_def
                                  bindE_assoc invocationCatch_use_injection_handler
                                  injection_bindE[OF refl refl] injection_handler_returnOk
                                  injection_handler_If
                             del: Collect_const cong: if_cong) apply (rule_tac xf'="\<lambda>s. (bufferCap_' s, bufferSlot_' s)" and
                                 r'="\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = cte_Ptr 0
                                                            | Some (cp, sl) \<Rightarrow> ccap_relation cp cp'
                                                                               \<and> args ! 3 \<noteq> 0
                                                                               \<and> sl' = cte_Ptr sl"
                                 in ccorres_splitE) apply (rule ccorres_cond2[where R=\<top>]) apply (clarsimp simp add: Collect_const_mem numeral_eqs) apply (rule_tac P="\<lambda>s. args ! 3 = 0" in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_split_nothrowE) apply (simp add: numeral_eqs) apply (ctac add: ccorres_injection_handler_csum1[OF deriveCap_ccorres]) apply ceqv apply simp apply (clarsimp simp: numeral_eqs) apply csymbr apply (rule ccorres_split_nothrowE) apply (ctac add: ccorres_injection_handler_csum1[OF checkValidIPCBuffer_ccorres]) apply ceqv apply (match premises in "ccap_relation _ (deriveCap_ret_C.cap_C ccap)" for ccap
                                    \<Rightarrow> \<open>rule ccorres_from_vcg
                                          [where P'="{s. bufferCap_' s = (deriveCap_ret_C.cap_C ccap)
                                                         \<and> bufferSlot_' s = cte_Ptr (snd (extraCaps ! 2))}"
                                             and P="\<lambda>s. args ! 3 \<noteq> 0"]\<close>) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def numeral_eqs) apply (rule_tac P'="{s. err' = errstate s}"
                                          in ccorres_from_vcg_throws[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def
                                                syscall_error_rel_def
                                                intr_and_se_rel_def) apply wp apply simp apply (vcg exspec=checkValidIPCBuffer_modifies) apply simp apply (rule_tac P'="{s. err' = errstate s}"
                                       in  ccorres_from_vcg_split_throws[where P=\<top>]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def
                                             intr_and_se_rel_def syscall_error_rel_def) apply simp apply (wp injection_wp_E [OF refl]) apply (simp add: all_ex_eq_helper Collect_const_mem numeral_eqs) apply (vcg exspec=deriveCap_modifies) apply (rule ceqv_tuple2, ceqv, ceqv) apply (rename_tac rv'dc) apply (rule_tac P="P (fst rv'dc) (snd rv'dc)"
                               and P'="P' (fst rv'dc) (snd rv'dc)"
                               for P P' in ccorres_inst) apply (clarsimp simp: tcb_cnode_index_defs
                                           [THEN ptr_add_assertion_positive
                                             [OF ptr_add_assertion_positive_helper]]
                                   simp del: Collect_const) apply csymbr apply (rule ccorres_move_array_assertion_tcb_ctes ccorres_Guard_Seq)+ apply (simp add: decodeSetSpace_def injection_bindE[OF refl] split_def
                               del: Collect_const) apply (simp add: injection_liftE[OF refl] bindE_assoc
                                    liftM_def getThreadCSpaceRoot
                                    getThreadVSpaceRoot del: Collect_const) apply (simp add: liftE_bindE del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (ctac add: slotCapLongRunningDelete_ccorres) apply (rule ccorres_move_array_assertion_tcb_ctes) apply (simp del: Collect_const) apply csymbr apply (clarsimp simp add: if_1_0_0 from_bool_0
                                     simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_symb_exec_l3
                                    [OF _ _ _ empty_fail_slotCapLongRunningDelete]) apply (simp add: unlessE_def injection_handler_throwError
                                    cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule ccorres_cond_true_seq) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply wp+ apply (rule ccorres_rhs_assoc)+ apply csymbr apply (simp del: Collect_const) apply (rule ccorres_move_array_assertion_tcb_ctes ccorres_Guard_Seq
                                 ccorres_rhs_assoc)+ apply (ctac add: slotCapLongRunningDelete_ccorres) apply (rule ccorres_move_array_assertion_tcb_ctes) apply (simp del: Collect_const) apply csymbr apply (clarsimp simp add: if_1_0_0 from_bool_0
                                       simp del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: unlessE_def injection_handler_throwError
                                    cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: unlessE_def injection_handler_returnOk
                                   del: Collect_const) apply (rule ccorres_add_return,
                              rule_tac r'="\<lambda>rv rv'. ccap_relation
                                                      (if args ! 1 = 0
                                                       then fst (hd extraCaps)
                                                       else updateCapData False (args ! 1) (fst (hd extraCaps))) rv'"
                                   and xf'="cRootCap_'"
                                   in ccorres_split_nothrow) apply (rule_tac P'="{s. cRootCap = cRootCap_' s}"
                                          in ccorres_from_vcg[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (subgoal_tac "extraCaps \<noteq> []") apply (clarsimp simp: returnOk_def return_def hd_conv_nth) apply fastforce apply clarsimp apply ceqv apply (ctac add: ccorres_injection_handler_csum1
                                            [OF deriveCap_ccorres]) apply (simp add: Collect_False del: Collect_const) apply (csymbr, csymbr) apply (simp add: cap_get_tag_isCap cnode_cap_case_if
                                        del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: injection_handler_throwError
                                         cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: injection_handler_returnOk del: Collect_const) apply (rule ccorres_add_return,
                                   rule_tac r'="\<lambda>rv rv'. ccap_relation
                                                           (if args ! 2 = 0
                                                            then fst (extraCaps ! Suc 0)
                                                            else updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'"
                                        and xf'="vRootCap_'"
                                        in ccorres_split_nothrow) apply (rule_tac P'="{s. vRootCap = vRootCap_' s}"
                                                in ccorres_from_vcg[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: returnOk_def return_def
                                                      hd_drop_conv_nth2) apply fastforce apply ceqv apply (ctac add: ccorres_injection_handler_csum1
                                                 [OF deriveCap_ccorres]) apply (simp add: Collect_False del: Collect_const) apply csymbr apply csymbr apply (simp add: from_bool_0 isValidVTableRoot_conv del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: injection_handler_throwError
                                              cong: StateSpace.state.fold_congs globals.fold_congs) apply (rule syscall_error_throwError_ccorres_n) apply (simp add: syscall_error_to_H_cases) apply (simp add: injection_handler_returnOk ccorres_invocationCatch_Inr
                                                  performInvocation_def) apply (ctac add: setThreadState_ccorres) apply csymbr apply (ctac(no_vcg) add: invokeTCB_ThreadControl_ccorres) apply (simp, rule ccorres_alternative2) apply (rule ccorres_return_CE, simp+) apply (rule ccorres_return_C_errorE, simp+)[1] apply wp apply (simp add: o_def) apply (wp sts_invs_minor' hoare_case_option_wp) apply (simp add: Collect_const_mem cintr_def intr_and_se_rel_def
                                                  exception_defs
                                            cong: option.case_cong) apply (vcg exspec=setThreadState_modifies) apply simp apply (rule ccorres_split_throws, rule ccorres_return_C_errorE, simp+) apply vcg apply simp apply (wp injection_wp_E[OF refl] hoare_drop_imps) apply (vcg exspec=deriveCap_modifies) apply (simp add: pred_conj_def cong: if_cong) apply wp apply (simp add: Collect_const_mem) apply (vcg) apply simp apply (rule ccorres_split_throws, rule ccorres_return_C_errorE, simp+) apply vcg apply (simp cong: if_cong) apply (wp injection_wp_E[OF refl] hoare_drop_imps) apply (simp add: Collect_const_mem intr_and_se_rel_def
                                          syscall_error_rel_def exception_defs
                                    cong: option.case_cong sum.case_cong) apply (simp add: all_ex_eq_helper numeral_eqs) apply (vcg exspec=deriveCap_modifies) apply (simp cong: if_cong) apply wp apply (simp add: Collect_const_mem del: Collect_const) apply vcg apply (simp cong: if_cong) apply (wp | wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem all_ex_eq_helper
                                cong: option.case_cong) apply (vcg exspec=slotCapLongRunningDelete_modifies) apply (simp cong: if_cong) apply (wp | wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem) apply (vcg exspec=slotCapLongRunningDelete_modifies) apply (simp add: pred_conj_def cong: if_cong) apply (wp injection_wp_E[OF refl] checkValidIPCBuffer_ArchObject_wp) apply simp apply (wp | wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem all_ex_eq_helper) apply (rule_tac P="{s. cRootCap_' s = cRootCap \<and> vRootCap_' s = vRootCap
                                        \<and> bufferAddr_' s = args ! 3
                                        \<and> ccap_relation cp cap' \<and> isThreadCap cp
                                        \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits
                                        \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread}"
                          in conseqPre) apply (simp add: cong: option.case_cong) apply (vcg exspec=deriveCap_modifies exspec=checkValidIPCBuffer_modifies) apply (clarsimp simp: excaps_map_def Collect_const_mem ccHoarePost_def
                                       numeral_eqs
                                 cong: option.case_cong) apply (frule interpret_excaps_eq[rule_format, where n=0], clarsimp) apply (frule interpret_excaps_eq[rule_format, where n=1], clarsimp) apply (frule interpret_excaps_eq[rule_format, where n=2], clarsimp) apply (clarsimp simp: mask_def[where n=4] ccap_rights_relation_def
                                       rightsFromWord_wordFromRights capTCBPtr_eq
                                       ptr_val_tcb_ptr_mask2[unfolded mask_def objBits_defs, simplified]
                                       tcb_cnode_index_defs size_of_def
                                       option_to_0_def rf_sr_ksCurThread
                                       StrictC'_thread_state_defs mask_eq_iff_w2p word_size
                                       from_bool_all_helper all_ex_eq_helper
                                       ucast_ucast_mask objBits_defs) apply (subgoal_tac "args \<noteq> [] \<and> extraCaps \<noteq> []") apply (simp add: word_sle_def cap_get_tag_isCap numeral_eqs
                                   hd_conv_nth hd_drop_conv_nth2
                                   word_FF_is_mask split_def
                                   thread_control_update_priority_def
                                   thread_control_update_mcp_def
                                   thread_control_update_space_def
                                   thread_control_update_ipc_buffer_def) apply (auto split: option.split elim!: inl_inrE)[1] apply (fastforce+)[2] apply clarsimp apply (strengthen if_n_updateCapData_valid_strg) apply (wp | wp (once) hoare_drop_imps)+ apply (clarsimp simp: Collect_const_mem all_ex_eq_helper
                               cong: option.case_cong) apply vcg apply simp apply (wp | wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem all_ex_eq_helper) apply vcg apply simp apply (wp | wp (once) hoare_drop_imps)+ apply (wpsimp | vcg exspec=getSyscallArg_modifies)+ apply (clarsimp simp: Collect_const_mem all_ex_eq_helper) apply (rule conjI) apply (clarsimp simp: idButNot_def interpret_excaps_test_null
                         excaps_map_def neq_Nil_conv) apply (clarsimp simp: sysargs_rel_to_n word_less_nat_alt) apply (frule invs_mdb') apply (frule(2) tcb_at_capTCBPtr_CL) apply (rule conjI, fastforce) apply (drule interpret_excaps_eq) apply (clarsimp simp: cte_wp_at_ctes_of valid_tcb_state'_def numeral_eqs le_ucast_ucast_le
                         tcb_at_invs' invs_valid_objs' invs_queues invs_sch_act_wf'
                         ct_in_state'_def pred_tcb_at'_def obj_at'_def tcb_st_refs_of'_def) apply (erule disjE; simp add: objBits_defs mask_def) apply (clarsimp simp: idButNot_def interpret_excaps_test_null
                        excaps_map_def neq_Nil_conv word_sle_def word_sless_def) apply (frule interpret_excaps_eq[rule_format, where n=0], simp) apply (frule interpret_excaps_eq[rule_format, where n=1], simp) apply (frule interpret_excaps_eq[rule_format, where n=2], simp) apply (clarsimp simp: mask_def[where n=4] ccap_rights_relation_def
                        rightsFromWord_wordFromRights
                        capTCBPtr_eq
                        tcb_cnode_index_defs size_of_def
                        option_to_0_def rf_sr_ksCurThread
                        StrictC'_thread_state_defs mask_eq_iff_w2p word_size
                        from_bool_all_helper) apply (frule(1) tcb_at_h_t_valid [OF tcb_at_invs']) apply (clarsimp simp: typ_heap_simps numeral_eqs isCap_simps valid_cap'_def capAligned_def
                        objBits_simps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. interpret_excaps extraCaps' = excaps_map extraCaps \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and K (isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) (UNIV \<inter> \<lbrace>ccap_relation cp \<acute>cap\<rbrace> \<inter> \<lbrace>unat \<acute>length___unsigned_long = length args\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>current_extra_caps = extraCaps'\<rbrace> \<inter> \<lbrace>\<acute>buffer = option_to_ptr buffer\<rbrace>) [] (decodeTCBConfigure args cp slot extraCaps >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Call decodeTCBConfigure_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9133 buffera current_extra_caps slota length___unsigned_long cap) (?Q'9133 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length___unsigned_long < 4 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 3,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferAddr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q9133 buffera current_extra_caps slota length___unsigned_long cap s \<and> s' \<in> ?Q'9133 buffera current_extra_caps slota length___unsigned_long cap proof (prove)
goal (2 subgoals):
 1. \<And>buffera current_extra_caps slota length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9133 buffera current_extra_caps slota length___unsigned_long cap) (?G'9141 buffera current_extra_caps slota length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length___unsigned_long < 4 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if excaprefs_C current_extra_caps.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 0,buffera);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 1,buffera);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 2,buffera);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(SCAST(32 signed \<rightarrow> 32) 3,buffera);;
(\<acute>cRootSlot :== excaprefs_C current_extra_caps.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C current_extra_caps.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C current_extra_caps.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C current_extra_caps.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C current_extra_caps.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbCTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned && ~~ ((1 << unat 9) - 1)) +\<^sub>p sint Kernel_C.tcbVTable);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) \<acute>current_syscall_error;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr (UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned),slota,\<acute>faultEP,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferAddr,\<acute>bufferCap,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q9133 buffera current_extra_caps slota length___unsigned_long cap s \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> ?G'9141 buffera current_extra_caps slota length___unsigned_long cap} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9133 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'9141 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF length___unsigned_long < 4 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ?Q9133 buffera current_extra_caps slota length___unsigned_long cap s \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> ?G'9141 buffera current_extra_caps slota length___unsigned_long cap} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9410 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S9412 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> ?Q9410 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> ?S9412 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9410 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?R'9436 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> ?Q9410 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> ?R'9436 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9439 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> ?R'9439 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 4\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length___unsigned_long < 4\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; length args < 4; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) x\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9411 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> ?T9411 buffera current_extra_caps slota length___unsigned_long cap)}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9409 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'9604 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ?R9409 buffera current_extra_caps slota length___unsigned_long cap s)) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> ?G'9604 buffera current_extra_caps slota length___unsigned_long cap})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9861 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S9863 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q9861 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S9863 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9861 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?R'9884 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q9861 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?R'9884 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'9887 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> ?R'9887 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map []; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length args < 4; (\<sigma>, x) \<in> rf_sr; idButNot excaprefs_C extraCaps'.[0] = NULL; extraCaps = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case [] of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) x\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T9862 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T9862 buffera current_extra_caps slota length___unsigned_long cap)}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R9860 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'9963 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R9860 buffera current_extra_caps slota length___unsigned_long cap s))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> ?G'9963 buffera current_extra_caps slota length___unsigned_long cap})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10215 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S10217 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q10215 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S10217 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q10215 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?R'10225 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q10215 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?R'10225 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10228 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> ?R'10228 buffera current_extra_caps slota length___unsigned_long cap \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length args < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; (\<sigma>, x) \<in> rf_sr; length (excaps_map extraCaps) \<le> Suc 0; idButNot excaprefs_C extraCaps'.[Suc 0] = NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) x\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T10216 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>ret__int :== (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T10216 buffera current_extra_caps slota length___unsigned_long cap)}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R10214 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?G'10394 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R10214 buffera current_extra_caps slota length___unsigned_long cap s)))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> ?G'10394 buffera current_extra_caps slota length___unsigned_long cap})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q11075 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S11077 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q11075 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S11077 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q11075 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?S11077 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q11075 buffera current_extra_caps slota length___unsigned_long cap s) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S11077 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11081 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) {},UNIV
 2. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> ?R'11081 buffera current_extra_caps slota length___unsigned_long cap) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))}
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long cap \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length args < 4; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; (\<sigma>, x) \<in> rf_sr; length (excaps_map extraCaps) \<le> 2; idButNot excaprefs_C extraCaps'.[2] = NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (\<lambda>y. ()) ret__unsigned_long_' (globals_update (current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_TruncatedMessage))) x\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR, global_exn_var_' := Return\<rparr>))
 2. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; \<not> length___unsigned_long < 4; \<not> (if extraCaps = [] \<and> idButNot excaprefs_C extraCaps'.[0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C extraCaps'.[Suc 0] = NULL then 1 else 0) \<noteq> 0; \<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C extraCaps'.[2] = NULL then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (SKIP;;
(\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length___unsigned_long cap) [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap);;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL\<rbrakk> \<Longrightarrow> 3 \<le> length extraCaps
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (3 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL\<rbrakk> \<Longrightarrow> 3 \<le> length extraCaps
 2. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 3. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; extraCaps = [] \<longrightarrow> idButNot excaprefs_C extraCaps'.[0] \<noteq> NULL; length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C extraCaps'.[Suc 0] \<noteq> NULL; length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C extraCaps'.[2] \<noteq> NULL; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] ((case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [faultEP, cRootData, vRootData] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | faultEP # cRootData # vRootData # buffer # xa \<Rightarrow> case extraCaps of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [cRoot, vRoot] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | cRoot # vRoot # bufferFrame # xaa \<Rightarrow> doE setIPCParams <- decodeSetIPCBuffer [buffer] cp slot [bufferFrame];
setSpace <- decodeSetSpace [faultEP, cRootData, vRootData] cp slot [cRoot, vRoot];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE) >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [hd (tl (tl (tl args)))] cp slot [hd (tl (tl extraCaps))];
setSpace <- decodeSetSpace [hd args, hd (tl args), hd (tl (tl args))] cp slot [hd extraCaps, hd (tl extraCaps)];
returnOk $ tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) Nothing Nothing (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams)
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (2 subgoals):
 1. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R11074 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') (?T11076 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer);;
(\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,\<acute>faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer));;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))))
 2. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ?R11074 buffera current_extra_caps slota length___unsigned_long cap s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T11076 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (4 subgoals):
 1. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q11364 length' cap' rv) (?Q'11364 length' cap' rv faultEP) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer);;
(\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),\<acute>bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))))
 2. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>?Q11364 length' cap'\<rbrace>
 3. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> ?Q'11364 length' cap' rv (faultEP_' s)}
 4. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (6 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q12540 length' cap' rv faultEP rva) (?Q'12540 length' cap' rv faultEP rva cRootData) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer);;
(\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF \<acute>vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,\<acute>vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),\<acute>bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>?Q12540 length' cap' rv faultEP\<rbrace>
 3. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> ?Q'12540 length' cap' rv faultEP rva (cRootData_' s)}
 4. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 5. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 6. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (8 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q13637 length' cap' rv faultEP rva cRootData rvb) (?Q'13637 length' cap' rv faultEP rva cRootData rvb vRootData) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer);;
(\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF \<acute>bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(\<acute>bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),\<acute>bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>?Q13637 length' cap' rv faultEP rva cRootData\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> ?Q'13637 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 4. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 5. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 6. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 7. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 8. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14708 length' cap' rv faultEP rva cRootData rvb vRootData rvc) (?Q'14708 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>cRootSlot :== excaprefs_C extraCaps'.[0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>cRootSlot,\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,\<acute>cRootSlot,\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>?Q14708 length' cap' rv faultEP rva cRootData rvb vRootData\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> ?Q'14708 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s)}
 4. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 6. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 8. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q14708 length' cap' rv faultEP rva cRootData rvb vRootData rvc) (?G'15752 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>?Q14708 length' cap' rv faultEP rva cRootData rvb vRootData\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?G'15752 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 6. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 8. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P16770 length' cap' rv faultEP rva cRootData rvb vRootData rvc) (?G'15752 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[0]} (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ?P16770 length' cap' rv faultEP rva cRootData rvb vRootData rvc s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?G'15752 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 6. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 8. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (10 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A16773 length' cap' rv faultEP rva cRootData rvb vRootData rvc) (?C'16772 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 0));
_ <- assert (rv = fst (extraCaps ! 0));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C'']));;
(\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,\<acute>cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (?A16773 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> ?C'16772 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 6. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 8. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) (?Q'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) [SKIP] (do _ <- assert (rvd = fst (extraCaps ! 0));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>?Q16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> ?Q'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s)}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G17413 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) (?G'17411 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>vRootSlot :== excaprefs_C extraCaps'.[Suc 0];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(\<acute>vRootSlot,\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,\<acute>vRootSlot,\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ?G17413 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> ?G'17411 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G17413 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) (?G'17417 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[Suc 0]} (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ?G17413 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> ?G'17417 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s)}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A18399 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) (?C'18398 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> (?A18399 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> ?C'18398 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P18403 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) (?C'18398 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 1));
_ <- assert (rv = fst (extraCaps ! 1));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']));;
(\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,\<acute>vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ?P18403 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> ?C'18398 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve) (?Q'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) [SKIP] (do _ <- assert (rve = fst (extraCaps ! 1));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>?Q18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> ?Q'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s)}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G19171 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve) (?G'19169 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (\<acute>bufferSlot :== excaprefs_C extraCaps'.[2];;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(\<acute>bufferSlot,\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ?G19171 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> ?G'19169 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G19171 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve) (?G'19175 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ?G19171 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> ?G'19175 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s)}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19509 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve) (?G'19175 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 2));
_ <- assert (rv = fst (extraCaps ! 2));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c excaprefs_C extraCaps'.[2]} (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ?P19509 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> ?G'19175 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s)}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A19512 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve) (?C'19511 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) [SKIP] (do rv <- getSlotCap (snd (extraCaps ! 2));
_ <- assert (rv = fst (extraCaps ! 2));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (\<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']));;
(IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],\<acute>bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> (?A19512 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> ?C'19511 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1); ccap_relation rvf bufferCap\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) (?Q'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) [SKIP] (do _ <- assert (rvf = fst (extraCaps ! 2));
doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB
od) (IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>?Q19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> ?Q'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1); ccap_relation rvf bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G19805 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) (?G'19803 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) [SKIP] (doE setIPCParams <- decodeSetIPCBuffer [args ! Suc (Suc (Suc 0))] cp slot [extraCaps ! Suc (Suc 0)];
setSpace <- decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0];
returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot setSpace) (tcNewFaultEP setSpace) None None (tcNewCRoot setSpace) (tcNewVRoot setSpace) (tcNewIPCBuffer setIPCParams))
odE >>= invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB) (IF bufferAddr = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(bufferAddr,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF cRootData \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,cRootData,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF vRootData \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,vRootData,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,faultEP,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),bufferAddr,\<acute>bufferCap);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ?G19805 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> ?G'19803 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G19805 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?G'19803 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE x <- if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE;
xa <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot xa) (tcNewFaultEP xa) None None (tcNewCRoot xa) (tcNewVRoot xa) (Some (args ! Suc (Suc (Suc 0)), x))))
odE) (IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI;;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ?G19805 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> ?G'19803 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?P19828 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?P'19821 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI)
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> (?P19828 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> ?P'19821 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s) \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0) = (s' \<in> \<lbrace>args ! 3 = 0\<rbrace>)
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt19841 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rt19837 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (returnOk None) (\<acute>bufferSlot :== NULL)
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf19839 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rf19835 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> ?Pt19841 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> ?Pf19839 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt19837 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf19835 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pt19841 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rt19837 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (returnOk None) (\<acute>bufferSlot :== NULL)
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf19839 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rf19835 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> ?Pt19841 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> ?Pf19839 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rt19837 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf19835 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. args ! 3 = 0 \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>bufferSlot :== NULL {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk None \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl) rv (bufferCap_' s, bufferSlot_' s)}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf19839 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rf19835 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> ?Pf19839 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf19835 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> {s. args ! 3 = 0 \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk None \<sigma>). (\<sigma>', bufferSlot_'_update (\<lambda>_. NULL) s) \<in> rf_sr \<and> inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl) rv (bufferCap_' s, NULL)}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf19839 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rf19835 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> ?Pf19839 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf19835 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf19839 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rf19835 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> ?Pf19839 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf19835 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Pf19839 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?Rf19835 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> ?Pf19839 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> ?Rf19835 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ccorres (?f'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap \<currency> ?r'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (liftxf (?es19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (?vf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap)) (?P19892 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))) (?P'19885 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) [SKIP] (injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))))) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI))) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ?r'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (?vf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv'); ?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ?r'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (?vf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s)) \<longrightarrow> s \<in> ?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s))) \<and> (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. ?f'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s)) (?es19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) (?es19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s)))}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! Suc (Suc 0); bufferAddr = args ! Suc (Suc (Suc 0)); ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; rvf = fst (extraCaps ! Suc (Suc 0))\<rbrakk> \<Longrightarrow> ccorres (?f'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap \<currency> ?r'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (liftxf (?es19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (?vf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap)) (?P19892 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! Suc (Suc 0)) () (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0)))) (?P'19885 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! Suc (Suc 0)) () (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap) [SKIP] (injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))))) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc (Suc 0)],bufferCap))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI))) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ?r'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (?vf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv'); ?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ?r'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (?vf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s)) \<longrightarrow> s \<in> ?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s))) \<and> (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. ?f'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (?ef'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s)) (?es19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (?xf'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s) (?es19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap s)))}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> dc_ret_' rv' t t' (IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI))) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (?d'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?Q'19883 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv) (?Q'19883 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19883 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv) (?G'20063 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') [SKIP] (doE rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE) (\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv');;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>?Q19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?G'20063 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (?f'20143 length' cap' cRootCap vRootCap bufferCap rv rv' \<currency> ?r'20143 length' cap' cRootCap vRootCap bufferCap rv rv') (liftxf (?es20143 length' cap' cRootCap vRootCap bufferCap rv rv') (?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv') (?vf'20143 length' cap' cRootCap vRootCap bufferCap rv rv') (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv')) (?P20150 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv) (?P'20145 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') [SKIP] (injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv)) (\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv'))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv') rv'a t t' (IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI) (?d'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?r'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva (?vf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a); ?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva) (?Q'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a) [SKIP] (returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))) (?d'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a)
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ?f'20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a) err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv' err) (?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err') [SKIP] (throwError err) (?d'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a)
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>?Q20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>, \<lbrace>?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv' (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ?r'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva (?vf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' s)) \<longrightarrow> s \<in> ?Q'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' s))) \<and> (?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv' (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. ?f'20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (?ef'20143 length' cap' cRootCap vRootCap bufferCap rv rv' (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' s)) (?es20143 length' cap' cRootCap vRootCap bufferCap rv rv' s) \<longrightarrow> s \<in> ?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (?xf'20143 length' cap' cRootCap vRootCap bufferCap rv rv' s) (?es20143 length' cap' cRootCap vRootCap bufferCap rv rv' s)))}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. ?P20150 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?P'20145 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s) \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ceqv \<Gamma> e_' rv'a t t' (IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI) (?d'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a)
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rva (K () rv'a); id rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva) (?Q'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a) [SKIP] (returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))) (?d'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv' err) (?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err') [SKIP] (throwError err) (?d'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rv'a)
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>?Q20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>, \<lbrace>?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (e_' s)) \<longrightarrow> s \<in> ?Q'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (e_' s) (errstate s)))}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rva (K () rv'a); id rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva) (?Q'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a) [SKIP] (returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI)
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv' err) (?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err') [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>?Q20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>, \<lbrace>?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. dc rva (K () (e_' s)) \<longrightarrow> s \<in> ?Q'20143 length' cap' cRootCap vRootCap bufferCap rv rv' rva (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (e_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rva (K () rv'a); id rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. args ! 3 \<noteq> 0 \<and> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0)))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl) rv (bufferCap_' s, bufferSlot_' s)}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv' err) (?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err') [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>\<lambda>_ a. args ! 3 \<noteq> 0\<rbrace>, \<lbrace>?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (e_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' rva rv'a \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; dc rva (K () rv'a); id rv'a = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> {s. args ! 3 \<noteq> 0 \<and> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False) \<and> (\<not> rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0)))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl) rv (bufferCap_' s, bufferSlot_' s)))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv' err) (?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err') [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>\<lambda>_ a. args ! 3 \<noteq> 0\<rbrace>, \<lbrace>?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (e_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv' err) (?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err') [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI)
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>\<lambda>_ a. args ! 3 \<noteq> 0\<rbrace>, \<lbrace>?QE20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''20143 length' cap' cRootCap vRootCap bufferCap rv rv' err (e_' s) (errstate s)))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. err' = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI {},{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>\<lambda>_ a. args ! 3 \<noteq> 0\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa}))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv' err rv'a err' \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id rv'a) err'\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. err' = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := rv'a, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := rv'a, global_exn_var_' := Return\<rparr>)))) \<and> (\<not> rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> False)}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>\<lambda>_ a. args ! 3 \<noteq> 0\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa}))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?R20148 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv\<rbrace> injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv) \<lbrace>\<lambda>_ a. args ! 3 \<noteq> 0\<rbrace>, \<lbrace>\<lambda>err _. True\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa}))}
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and ?R20148 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> \<lbrace>\<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>)) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (id (e_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa}))}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; ccap_relation rv (deriveCap_ret_C.cap_C rv'); deriveCap_ret_C.status_C rv' = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F20143 length' cap' cRootCap vRootCap bufferCap rv rv'\<^esub> (?R'20144 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap rv rv') \<acute>e :== CALL checkValidIPCBuffer_'proc(args ! Suc (Suc (Suc 0)),deriveCap_ret_C.cap_C rv') \<lbrace>\<acute>e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C rv' \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> ?R'20144 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err) (?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err') [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv')
FI;;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (inl_rrel (intr_and_se_rel \<currency> dc)) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE19883 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap err) (?Q''19883 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap err rv' err') [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv');;
(\<acute>bufferCap :== deriveCap_ret_C.cap_C rv';;
(\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI)))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>?QE19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'20297 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap err rv' err') return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv') {},UNIV
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err' \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. err' = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv') UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> ?R'20297 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err' \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. err' = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv') UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap err rv' err' \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); deriveCap_ret_C.status_C rv' \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'a. err = Inl rv'a \<and> syscall_error_rel rv'a (deriveCap_ret_C.status_C rv') err'\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. err' = errstate s} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (throwError err \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := deriveCap_ret_C.status_C rv', global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (intr_and_se_rel \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := deriveCap_ret_C.status_C rv', global_exn_var_' := Return\<rparr>))}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>True\<rbrace>))}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a. invs' and (\<lambda>a. True \<and> args ! 3 \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19890 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0)))) \<lbrace>\<lambda>a b. invs' b \<and> args ! 3 \<noteq> 0\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and ?R19890 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. bufferCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) (vptr_'_update (\<lambda>_. bufferAddr) sa) \<in> UNIV \<inter> \<lbrace>\<acute>vptr = bufferAddr\<rbrace> \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace>} \<inter> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> \<acute>bufferCap = deriveCap_ret_C.cap_C \<^bsup>s\<^esup>dc_ret \<and> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! 2))\<rbrace>})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. errstate s = errstate sa} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! Suc (Suc 0); bufferAddr = args ! Suc (Suc (Suc 0)); ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; rvf = fst (extraCaps ! Suc (Suc 0))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19883 length' cap' (args ! 0) (args ! Suc 0) (args ! Suc (Suc 0)) (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap\<^esub> (?R'19884 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! Suc (Suc 0)) () (args ! Suc (Suc (Suc 0))) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! Suc (Suc 0))) bufferCap) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc (Suc 0)],bufferCap) \<lbrace>deriveCap_ret_C.status_C \<acute>dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<acute>dc_ret)) \<longrightarrow> (\<exists>t. \<^bsup>t\<^esup>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> ?R'19884 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s))} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) rv' t t' (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],\<acute>bufferSlot,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv')
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv' of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv') [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],snd rv',SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,fst rv');;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'dc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv'dc of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'dc) [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],snd rv'dc,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,fst rv'dc);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v. ?Q'19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v))),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'dc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); case rv'dc of (cp', sl') \<Rightarrow> case rv of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv) (?P'21775 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap rv rv'dc (fst rv'dc) (snd rv'dc)) [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbCTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>ptr_add_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (sint Kernel_C.tcbVTable) False (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],snd rv'dc,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,fst rv'dc);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. ?P'21775 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc))),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?P'21775 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b) [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. ?P'21775 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc))),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?G'21800 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b ret__unsigned) [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?G'21800 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?C'22062 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b ret__unsigned) [SKIP] (doE x <- injection_handler Inl (decodeSetSpace [hd args, args ! Suc 0, args ! Suc (Suc 0)] cp slot [hd extraCaps, extraCaps ! Suc 0]);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?C'22062 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?C'22062 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) [SKIP] (doE x <- doE rv <- injection_handler Inl (liftE (liftM Not (getThreadCSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete)));
rva <- injection_handler Inl (liftE (liftM Not (getThreadVSpaceRoot (capTCBPtr cp) >>= slotCapLongRunningDelete)));
rv <- injection_handler Inl (unlessE (rv \<and> rva) (throwError Fault_H.syscall_error.IllegalOperation));
rv <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
rv <- injection_handler Inl (case rv of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rv, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
rva <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
rva <- injection_handler Inl (if isValidVTableRoot rva then returnOk (rva, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some rv) (Some rva) None))
odE;
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?C'22062 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?C'22062 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) [SKIP] (doE x <- liftE (do x <- slotCapLongRunningDelete (capTCBPtr cp);
return (\<not> x)
od);
xa <- liftE (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
return (\<not> x)
od);
x <- injection_handler Inl (unlessE (x \<and> xa) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?C'22062 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?C'22062 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp);
xa <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> x \<and> \<not> xa) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?C'22062 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv) (?C'22062 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp);
xa <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> x \<and> \<not> xa) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C))));;
(Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))))
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>?Q19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?C'22062 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); ((=) \<circ> from_bool) rva ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q22084 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva) (?Q'22084 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (Guard MemorySafety \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>?Q22084 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'22084 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s)}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); ((=) \<circ> from_bool) rva ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A22353 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva) (?C'22352 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. ?A22353 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'22352 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); from_bool rva = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A22353 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?C'22352 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. ?A22353 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'22352 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); from_bool rva = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A22353 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?G'22373 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva ret__unsigned_long) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (IF (if ret__unsigned_long \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. ?A22353 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'22373 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A22353 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?G'22373 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (IF rva THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0)
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. ?A22353 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'22373 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?S22610 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> ?S22610 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s)) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q22613 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb) (?Q'22619 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva) rvb) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q22613 length' cap' cRootCap vRootCap bufferCap rv a b rva\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rvb. s' \<in> ?Q'22619 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) rvb}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q22613 length' cap' cRootCap vRootCap bufferCap rv a b True rvb) (?Q'22619 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) True (SCAST(32 signed \<rightarrow> 32) true) rvb) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q22613 length' cap' cRootCap vRootCap bufferCap rv a b rva\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rvb. s' \<in> ?Q'22619 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) rvb}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q22613 length' cap' cRootCap vRootCap bufferCap rv a b True rvb) (?R'22632 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) True (SCAST(32 signed \<rightarrow> 32) true) rvb) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q22613 length' cap' cRootCap vRootCap bufferCap rv a b rva\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rvb. s' \<in> ?R'22632 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) rvb \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a b. rva\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva s. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; rva\<rbrakk> \<Longrightarrow> \<lbrace>?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a b. rva\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q22608 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?T22609 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva)) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((\<acute>ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (\<acute>ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> ?T22609 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva) (?G'22655 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rva (from_bool rva) ret__unsigned) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> rva \<and> \<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((ret__unsigned && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (ret__unsigned && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'22655 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R22607 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False) (?G'22655 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP);;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R22607 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'22655 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A23020 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False) (?C'23017 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) [SKIP] (do x <- slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits);
doE x <- injection_handler Inl (unlessE (\<not> x) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE
od) (\<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C))));;
(Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if \<acute>ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (?A23020 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?C'23017 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); ((=) \<circ> from_bool) rvb ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q23031 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb) (?Q'23031 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (Guard MemorySafety \<lbrace>Kernel_C.tcbVTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbVTable)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>?Q23031 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?Q'23031 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); ((=) \<circ> from_bool) rvb ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A23530 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb) (?C'23529 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. ?A23530 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'23529 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); from_bool rvb = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A23530 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?C'23529 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__int :== (if ret__unsigned_long \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. ?A23530 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> ?C'23529 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s) \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); from_bool rvb = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A23530 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?G'23550 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF (if ret__unsigned_long \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. ?A23530 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'23550 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?A23530 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?G'23550 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb (from_bool rvb)) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF rvb THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. ?A23530 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'23550 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s)} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24148 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?S24151 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb (from_bool rvb)) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R24147 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?T24149 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb (from_bool rvb)) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q24148 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R24147 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> ?S24151 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s)) \<and> (\<not> rvb \<longrightarrow> sa \<in> ?T24149 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24148 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) True) (?S24151 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) True (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if args ! Suc 0 \<noteq> 0 then UNIV else {}) (\<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R24147 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?T24149 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb (from_bool rvb)) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> ?Q24148 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca) \<and> (\<not> c \<longrightarrow> ?R24147 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> ?S24151 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s)) \<and> (\<not> rvb \<longrightarrow> sa \<in> ?T24149 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; rvb\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R24147 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?T24149 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb (from_bool rvb)) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R24147 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> ?T24149 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R24147 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb) (?T24149 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) rvb (from_bool rvb)) [SKIP] (doE x <- injection_handler Inl (unlessE (\<not> rvb) (throwError Fault_H.syscall_error.IllegalOperation));
x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
x <- injection_handler Inl (returnOk (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) None));
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) (tcThreadCapSlot x) (tcNewFaultEP x) None None (tcNewCRoot x) (tcNewVRoot x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R24147 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> ?T24149 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R24147 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False) (?T24149 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ?R24147 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> ?T24149 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps)))) cRootCap_' (?P24175 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False) (?P'24168 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (return ()) (IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI)
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (?P24175 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> ?P'24168 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s) \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s)}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', cRootCap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (ret__struct_cap_C_' t))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s)))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', cRootCap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (ret__struct_cap_C_' t))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s)))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> extraCaps \<noteq> []
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' vRootCap bufferCap rv a b rva rvb \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; extraCaps \<noteq> []; (\<sigma>, x) \<in> rf_sr; args ! Suc 0 \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (extraCaps ! 0))) (ret__struct_cap_C_' t))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> extraCaps \<noteq> []
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> extraCaps \<noteq> []
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cRootCap_' rv' t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],\<acute>cRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv')
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc) (?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))));
x <- injection_handler Inl (case x of capability.CNodeCap xa xaa xb xc \<Rightarrow> returnOk (x, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv');;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>?Q24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> ?Q'24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
A total of 24 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd) (?Q'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd dc_ret) [SKIP] (doE x <- injection_handler Inl (case rvd of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvd, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF deriveCap_ret_C.status_C dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C dc_ret)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?Q'24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret) [SKIP] (doE x <- injection_handler Inl (case rvd of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvd, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>cRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?G'25104 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret ret__unsigned) [SKIP] (doE x <- injection_handler Inl (case rvd of capability.CNodeCap x xa xb xc \<Rightarrow> returnOk (rvd, snd (hd extraCaps)) | _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'25104 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?G'25104 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvd then returnOk (rvd, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF \<not> isCNodeCap rvd THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>?Q24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'25104 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25452 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?S25455 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvd then returnOk (rvd, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R25451 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?T25453 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvd then returnOk (rvd, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> ?Q25452 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ?R25451 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?S25455 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?T25453 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25452 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?S25455 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R25451 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?T25453 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvd then returnOk (rvd, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> ?Q25452 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ?R25451 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?S25455 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?T25453 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R25451 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?T25453 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvd then returnOk (rvd, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ?R25451 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?T25453 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); \<not> \<not> isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R25451 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?T25453 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (if isCNodeCap rvd then returnOk (rvd, snd (hd extraCaps)) else throw Fault_H.syscall_error.IllegalOperation);
xa <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
xa <- injection_handler Inl (if isValidVTableRoot xa then returnOk (xa, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some x) (Some xa) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ?R25451 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?T25453 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R25451 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?T25453 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ?R25451 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?T25453 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0)))) vRootCap_' (?P25483 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd) (?P'25476 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) [SKIP] (return ()) (IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI)
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc) (?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> (?P25483 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> ?P'25476 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s)}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc) (?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned \<sigma>. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (args ! 2 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', vRootCap_'_update (\<lambda>_. ret__struct_cap_C_' t) s) \<in> rf_sr \<and> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t))))) \<and> (\<not> args ! 2 \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return () \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s)))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc) (?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap bufferCap rv a b rva rvb rv' rvd dc_ret \<sigma> x. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; isCNodeCap rvd; (\<sigma>, x) \<in> rf_sr; args ! 2 \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc) (?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a t t'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> ceqv \<Gamma> vRootCap_' rv'a t t' (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc) (?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (?d'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a)
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc) (?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) [SKIP] (doE x <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))));
x <- injection_handler Inl (if isValidVTableRoot x then returnOk (x, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>?Q25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> ?Q'25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 29 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a rve dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a rve) (?Q'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a rve dc_ret) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF deriveCap_ret_C.status_C dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C dc_ret)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?Q'25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>vRootCap :== deriveCap_ret_C.cap_C dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> ?Q'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?G'25949 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(deriveCap_ret_C.cap_C dc_ret);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> ?G'25949 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s)})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot_C (deriveCap_ret_C.cap_C dc_ret))\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?G'26171 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret ret__unsigned_long) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'26171 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rve)\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?G'26171 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (from_bool (isValidVTableRoot rve))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (IF \<not> isValidVTableRoot rve THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>?Q25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'26171 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rve); \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q26346 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?S26349 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (from_bool (isValidVTableRoot rve))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rve); \<not> \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R26345 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?T26347 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (from_bool (isValidVTableRoot rve))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> ?Q26346 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ?R26345 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?S26349 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?T26347 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
A total of 33 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q26346 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?S26349 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) false)) [SKIP] (throwError (Inl Fault_H.syscall_error.IllegalOperation)) (\<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR);;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rve); \<not> \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R26345 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?T26347 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (from_bool (isValidVTableRoot rve))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> ?Q26346 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ?R26345 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?S26349 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?T26347 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
A total of 33 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long err' ft'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) false; \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> syscall_error_to_H (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation) err') ft' = Some Fault_H.syscall_error.IllegalOperation
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rve); \<not> \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R26345 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?T26347 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (from_bool (isValidVTableRoot rve))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ?R26345 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?T26347 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = from_bool (isValidVTableRoot rve); \<not> \<not> isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R26345 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?T26347 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (from_bool (isValidVTableRoot rve))) [SKIP] (doE x <- injection_handler Inl (if isValidVTableRoot rve then returnOk (rve, snd (extraCaps ! Suc 0)) else throw Fault_H.syscall_error.IllegalOperation);
invocationCatch thread isBlocking isCall Invocations_H.invocation.InvokeTCB (Inr (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some x) (Some (args ! Suc (Suc (Suc 0)), rv))))
odE) (SKIP;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ?R26345 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?T26347 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R26345 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve) (?T26347 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) [SKIP] (do _ <- setThreadState Structures_H.thread_state.Restart thread;
doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE
od) (CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ?R26345 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> ?T26347 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc xfdc. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q26368 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc) (?Q'26368 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc xfdc) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_'))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q26368 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> ?Q'26368 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
A total of 34 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q26368 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc) (?G'26428 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned) [SKIP] (doE reply <- invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv)));
if reply = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread reply isCall)
odE) (\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],deriveCap_ret_C.cap_C dc_ret,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>?Q26368 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> ?G'26428 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
A total of 34 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned rvf ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); rvf = []; id ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned rvf) (?Q'26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned rvf ret__unsigned_long) [SKIP] (if rvf = [] then liftE (replyOnRestart thread [] isCall) \<sqinter> returnOk () else liftE (replyOnRestart thread rvf isCall)) (return_C ret__unsigned_long_'_update (\<lambda>s. ret__unsigned_long))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned err) (?Q''26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) \<lbrace>?Q26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned\<rbrace>, \<lbrace>?QE26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>c. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) and (\<lambda>_. (Some (hd args) = None) = (Some (rvd, snd (hd extraCaps)) = None) \<and> (Some (rvd, snd (hd extraCaps)) = None) = (Some (rve, snd (extraCaps ! Suc 0)) = None) \<and> (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long c\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvf. rvf = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s) v rvf (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s) v err (ret__unsigned_long_' t) (errstate t)))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
A total of 36 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa xfdc ret__unsigned rvf ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); rvf = []; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q26512 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) []) (?Q'26512 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) [] (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (returnOk ()) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); id rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err (id rv'b) ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned err) (?Q''26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa rvc xfdc ret__unsigned err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) \<lbrace>?Q26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned\<rbrace>, \<lbrace>?QE26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>c. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) and (\<lambda>_. (Some (hd args) = None) = (Some (rvd, snd (hd extraCaps)) = None) \<and> (Some (rvd, snd (hd extraCaps)) = None) = (Some (rve, snd (extraCaps ! Suc 0)) = None) \<and> (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long c\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvf. rvf = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s) v rvf (ret__unsigned_long_' t))) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s) v err (ret__unsigned_long_' t) (errstate t)))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
A total of 36 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_longa xfdc ret__unsigned err rv'b ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_longa = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'); rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; cintr err rv'b ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE26512 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) err) (?Q''26512 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true) () xfdc (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) err rv'b ret__unsigned_long) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. rv'b))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>?QE26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>c. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) and (\<lambda>_. (Some (hd args) = None) = (Some (rvd, snd (hd extraCaps)) = None) \<and> (Some (rvd, snd (hd extraCaps)) = None) = (Some (rve, snd (extraCaps ! Suc 0)) = None) \<and> (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long c\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rvc. dc rvc (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {sa. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rvc (K rvc \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> sa\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q''26512 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long rvc (xfdc s) v err (ret__unsigned_long_' t) (errstate t)))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
A total of 35 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc xfdc ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigneda = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve; dc rvc xfdc; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigneda rv'a rve dc_ret ret__unsigned_long rvc\<rbrace> invokeTCB (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>c. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) and (\<lambda>_. (Some (hd args) = None) = (Some (rvd, snd (hd extraCaps)) = None) \<and> (Some (rvd, snd (hd extraCaps)) = None) = (Some (rve, snd (extraCaps ! Suc 0)) = None) \<and> (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and ?R26514 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long c\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rva (K rva \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a. invs' and sch_act_simple and tcb_inv_wf' (tcbinvocation.ThreadControl (capTCBPtr cp) slot (Some (hd args)) None None (Some (rvd, snd (hd extraCaps))) (Some (rve, snd (extraCaps ! Suc 0))) (Some (args ! Suc (Suc (Suc 0)), rv))) and (\<lambda>_. (Some (hd args) = None) = (Some (rvd, snd (hd extraCaps)) = None) \<and> (Some (rvd, snd (hd extraCaps)) = None) = (Some (rve, snd (extraCaps ! Suc 0)) = None) \<and> (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> slot \<noteq> 0)) and (\<lambda>s. True \<and> True)\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rva (K rva \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
A total of 33 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<lbrace>?R26376 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve\<rbrace> setThreadState Structures_H.thread_state.Restart thread \<lbrace>\<lambda>a b. invs' b \<and> sch_act_simple b \<and> tcb_at' (capTCBPtr cp) b \<and> ex_nonz_cap_to' (capTCBPtr cp) b \<and> valid_cap' rvd b \<and> valid_cap' rve b \<and> (case rv of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_cap' (fst x)) b \<and> (case rv of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd x)) b \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot b \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rva (K rva \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>c ca. (\<not> isValidVTableRoot c \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot c \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R26376 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a c) ca)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) {s. \<forall>rva. dc rva (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. bufferCap_'_update (\<lambda>x. a) (bufferAddr_'_update (\<lambda>x. args ! 3) (updateFlags_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer)) (bufferSrcSlot_'_update (\<lambda>_. b) (vRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) (vRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_ret) (cRoot_srcSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) (cRoot_newCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C dc_reta) (priority_'_update (\<lambda>_. 0) (mcp_'_update (\<lambda>_. 0) (faultep_'_update (\<lambda>_. args ! 0) (slot_'_update (\<lambda>_. cte_Ptr slot) (target_'_update (\<lambda>_. tcb_Ptr v) s)))))))))))) \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_ptr_to_ctcb_ptr (capTCBPtr cp)\<rbrace> \<inter> \<lbrace>Some (rvd, snd (hd extraCaps)) \<noteq> None \<or> Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None \<longrightarrow> \<acute>slot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>faultep = option_to_0 (Some (hd args))\<rbrace> \<inter> \<lbrace>\<acute>mcp = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>\<acute>priority = (case None of None \<Rightarrow> 0 | Some x \<Rightarrow> (UCAST(8 \<rightarrow> 32) \<circ> fst) x)\<rbrace> \<inter> \<lbrace>case Some (rvd, snd (hd extraCaps)) of None \<Rightarrow> True | Some (cRootCap, cRootSlot) \<Rightarrow> ccap_relation cRootCap \<acute>cRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>cRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rvd, snd (hd extraCaps)))))\<rbrace> \<inter> \<lbrace>case Some (rve, snd (extraCaps ! Suc 0)) of None \<Rightarrow> True | Some (vRootCap, vRootSlot) \<Rightarrow> ccap_relation vRootCap \<acute>vRoot_newCap\<rbrace> \<inter> \<lbrace>\<acute>vRoot_srcSlot = cte_Ptr (option_to_0 (map_option snd (Some (rve, snd (extraCaps ! Suc 0)))))\<rbrace> \<inter> \<lbrace>\<acute>bufferAddr = option_to_0 (map_option fst (Some (args ! Suc (Suc (Suc 0)), rv)))\<rbrace> \<inter> \<lbrace>\<acute>bufferSrcSlot = cte_Ptr (case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> 0 | Some (ptr, None) \<Rightarrow> 0 | Some (ptr, Some (cap, slot)) \<Rightarrow> slot)\<rbrace> \<inter> \<lbrace>case Some (args ! Suc (Suc (Suc 0)), rv) of None \<Rightarrow> True | Some (ptr, None) \<Rightarrow> True | Some (ptr, Some (cap, slot)) \<Rightarrow> ccap_relation cap \<acute>bufferCap\<rbrace> \<inter> \<lbrace>\<acute>updateFlags = (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_mcp else 0) || (if None \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_priority else 0) || (if Some (args ! Suc (Suc (Suc 0)), rv) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer else 0) || (if Some (rvd, snd (hd extraCaps)) \<noteq> None then SCAST(32 signed \<rightarrow> 32) thread_control_update_space else 0)\<rbrace>} \<inter> {s. \<forall>t. (id (ret__unsigned_long_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. rv = [] \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> \<lbrace>id \<^bsup>t\<^esup>ret__unsigned_long = \<^bsup>t\<^esup>ret__unsigned_long \<and> dc rva (K rva \<^bsup>t\<^esup>ret__unsigned_long)\<rbrace>)) \<and> (id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. cintr err (id (ret__unsigned_long_' t)) (errstate t) \<longrightarrow> s\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s. id (ret__unsigned_long_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> (intr_and_se_rel \<circ> Inr) err (id (ret__unsigned_long_' t)) (errstate s)}))}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap}}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>aa. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a rve dc_ret ret__unsigned_long. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = 0; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; ccap_relation rve (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = 0; ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) true; isValidVTableRoot rve\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a rve dc_ret (SCAST(32 signed \<rightarrow> 32) true)) CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>aa. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rve. ccap_relation rve (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {sa. (\<not> isValidVTableRoot rve \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rve \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> ?R'26369 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a rve (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
A total of 32 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rvc rv'a err rv'b dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b)
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>aa. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (\<not> isValidVTableRoot rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rva \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a err) (?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a err rv'b dc_ret) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b);;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C rv'b;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,deriveCap_ret_C.cap_C dc_reta,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>aa. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (\<not> isValidVTableRoot rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rva \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_reta ret__unsigned rv'a err rv'b dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_reta); deriveCap_ret_C.status_C dc_reta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_reta); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a; deriveCap_ret_C.status_C rv'b \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'b) dc_ret\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26723 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_reta (cap_get_tag (deriveCap_ret_C.cap_C dc_reta)) () rv'a err rv'b dc_ret) return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'b) {},UNIV
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>aa. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (\<not> isValidVTableRoot rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rva \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> ?R'26723 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
A total of 31 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. (\<not> isValidVTableRoot a \<longrightarrow> True) \<and> (\<not> \<not> isValidVTableRoot a \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Restart) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>aa. (st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = tcb_st_refs_of' Structures_H.thread_state.Restart \<and> (Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.Inactive \<and> Structures_H.thread_state.Restart \<noteq> Structures_H.thread_state.IdleThreadState \<longrightarrow> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState)) thread and (\<lambda>s. thread = ksIdleThread s \<longrightarrow> idle' Structures_H.thread_state.Restart) and (\<lambda>s. (\<exists>p. thread \<in> set (ksReadyQueues s p)) \<longrightarrow> runnable' Structures_H.thread_state.Restart) and (\<lambda>s. runnable' Structures_H.thread_state.Restart \<and> obj_at' tcbQueued thread s \<longrightarrow> st_tcb_at' runnable' thread s) and sch_act_simple and invs') aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (\<not> isValidVTableRoot rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rva \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R25662 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret)) ()\<rbrace> injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc 0)) (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0)))) \<lbrace>\<lambda>a aa. isValidVTableRoot a \<longrightarrow> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> (obj_at' tcbQueued thread aa \<longrightarrow> st_tcb_at' runnable' thread aa) \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' rvd aa \<and> valid_cap' a aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (\<not> isValidVTableRoot rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rva \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R25662 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd; ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc rv'a) \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],rv'a) {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. vRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = from_bool (isValidVTableRoot_C (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. (\<not> isValidVTableRoot rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isValidVTableRoot rva \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Restart) (tptr_'_update (\<lambda>_. ksCurThread_' (globals s)) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rvd a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> ?R'25660 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned rvc (vRootCap_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' rvd a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rva. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> {s. \<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>ta. s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, vRootCap_' := deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), ret__unsigned_long_' := from_bool (isValidVTableRoot_C (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), ksSchedulerAction_' := ksSchedulerAction_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))) \<longrightarrow> id (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t))) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))))}}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<lbrace>?R25481 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd\<rbrace> return () \<lbrace>\<lambda>rvc x. invs' x \<and> tcb_at' thread x \<and> Invariants_H.valid_queues x \<and> valid_objs' x \<and> valid_tcb_state' Structures_H.thread_state.Restart x \<and> sch_act_wf (ksSchedulerAction x) x \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread x \<and> thread \<noteq> ksIdleThread x \<and> st_tcb_at' runnable' thread x \<and> sch_act_simple x \<and> invs' x \<and> sch_act_simple x \<and> tcb_at' (capTCBPtr cp) x \<and> ex_nonz_cap_to' (capTCBPtr cp) x \<and> valid_cap' rvd x \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) x \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) x \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) x \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot x \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rva. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> {s. \<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>ta. s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, vRootCap_' := deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), ret__unsigned_long_' := from_bool (isValidVTableRoot_C (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), ksSchedulerAction_' := ksSchedulerAction_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))) \<longrightarrow> id (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t))) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))))}}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>c ca. (\<not> isCNodeCap c \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap c \<longrightarrow> ((\<lambda>a. True) and ?R25481 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' c) ca)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI {s. \<forall>rva. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. vRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc 0))\<rbrace>} \<inter> {s. \<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Restart (cl\<lparr>tsType_CL := SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4\<rparr>, fl)) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> (\<forall>ta. s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, vRootCap_' := deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), ret__unsigned_long_' := from_bool (isValidVTableRoot_C (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals ta), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals ta), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals ta), ksSchedulerAction_' := ksSchedulerAction_' (globals ta), t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr> \<in> (if tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})))) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))) \<longrightarrow> id (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t))) (errstate (dc_ret_'_update (\<lambda>_. ret__struct_deriveCap_ret_C_' t) (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))))}}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' rvd dc_ret ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; ccap_relation rvd (deriveCap_ret_C.cap_C dc_ret); deriveCap_ret_C.status_C dc_ret = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned = cap_get_tag (deriveCap_ret_C.cap_C dc_ret); isCNodeCap rvd\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F25473 length' cap' cRootCap vRootCap bufferCap rv a b False False rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))\<^esub> (?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' rvd dc_ret (cap_get_tag (deriveCap_ret_C.cap_C dc_ret))) Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP {s. ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>)))))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rvd. ccap_relation rvd (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. (\<not> isCNodeCap rvd \<longrightarrow> sa \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rvd \<longrightarrow> sa \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> ?R'25475 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' rvd (dc_ret_' s) v)}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 10. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err rv'a dc_ret) [SKIP] (throwError err) (IF deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a)
FI;;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(IF args ! 2 \<noteq> 0 THEN
  \<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)
FI;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rva \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>)))))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> ccorres (intr_and_se_rel \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' err) (?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' err rv'a dc_ret) [SKIP] (throwError err) (return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a);;
(\<acute>cRootCap :== deriveCap_ret_C.cap_C rv'a;;
(\<acute>ret__unsigned :== CALL cap_get_capType_'proc(\<acute>cRootCap);;
(IF \<acute>ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) cap_cnode_cap THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(Cond (if args ! 2 \<noteq> 0 then UNIV else {}) (\<acute>vRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! 2,vRootCap)) SKIP;;
(\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[Suc 0],\<acute>vRootCap);;
(IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
(\<acute>vRootCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
(\<acute>ret__unsigned_long :== CALL isValidVTableRoot_'proc(\<acute>vRootCap);;
(IF \<acute>ret__unsigned_long = 0 THEN
  \<acute>globals :== current_syscall_error_'_update (type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_IllegalOperation));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR)
FI;;
(CALL setThreadState_'proc(\<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
(\<acute>ret__unsigned :== CALL cap_thread_cap_get_capTCBPtr_'proc(cap');;
(\<acute>ret__unsigned_long :== CALL invokeTCB_ThreadControl_'proc(tcb_Ptr \<acute>ret__unsigned,cte_Ptr slot,args ! 0,0,0,\<acute>cRootCap,excaprefs_C extraCaps'.[0],\<acute>vRootCap,excaprefs_C extraCaps'.[Suc 0],b,SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer),args ! 3,a);;
return_C ret__unsigned_long_'_update ret__unsigned_long_')))))))))))))
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>?QE24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rva \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>)))))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> ?Q''24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv' err rv'a dc_ret. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'; deriveCap_ret_C.status_C rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; \<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C rv'a) dc_ret\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'26940 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv' err rv'a dc_ret) return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C rv'a) {},UNIV
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rva \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>)))))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> ?R'26940 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv' err (dc_ret_' s) (errstate s)))}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 9. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. (\<not> isCNodeCap a \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))) aa)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rva \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>)))))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R24387 length' cap' cRootCap vRootCap bufferCap rv a b False False ()\<rbrace> injection_handler Inl (global.deriveCap (snd (hd extraCaps)) (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps)))) \<lbrace>\<lambda>a aa. isCNodeCap a \<longrightarrow> invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' a aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rva \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>)))))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and ?R24387 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 8. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 10. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> s \<in> {sa. cRootCap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa \<in> {sa. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. deriveCap_ret_C.cap_C (dc_ret_' s)) sa)) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. (\<not> isCNodeCap rva \<longrightarrow> s \<in> UNIV) \<and> (\<not> \<not> isCNodeCap rva \<longrightarrow> s \<in> \<lbrace>vRootCap = \<acute>vRootCap\<rbrace> \<inter> {s. (s \<in> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool (SCAST(32 signed \<rightarrow> 32) false)) (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>)))))))) \<and> (s \<notin> (if args ! 2 \<noteq> 0 then UNIV else {}) \<longrightarrow> ccap_relation (if args ! 2 = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! 2) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))) \<longrightarrow> intr_and_se_rel err (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))})}}})) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> syscall_error_rel rv' (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s)) \<longrightarrow> s \<in> {sa. id (deriveCap_ret_C.status_C (dc_ret_' s)) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> intr_and_se_rel err (id (deriveCap_ret_C.status_C (dc_ret_' s))) (errstate sa)} \<inter> \<lbrace>True\<rbrace>))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') {s. (deriveCap_ret_C.status_C (dc_ret_' s) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (dc_ret_' s)) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = vRootCap_' s \<and> (args ! 2 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! 2) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! 2) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) \<noteq> 0 \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 3 \<and> syscall_error_to_H (current_syscall_error_' (globals ta)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some rv') \<longrightarrow> (case err of Inl se \<Rightarrow> deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 3 \<and> syscall_error_to_H (current_syscall_error_' (globals ta)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some se | Inr irq \<Rightarrow> cintr irq (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta)) (errstate (s\<lparr>cRootCap_' := deriveCap_ret_C.cap_C (dc_ret_' s), ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (dc_ret_' s)), vRootCap_' := ret__struct_cap_C_' t, globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>))))))))) \<and> (args ! 2 = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' s) \<longrightarrow> ccap_relation (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (vRootCap_' s) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> args ! 3 = args ! Suc (Suc (Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) \<noteq> 0 \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 3 \<and> syscall_error_to_H (current_syscall_error_' (globals t)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some rv') \<longrightarrow> (case err of Inl se \<Rightarrow> deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 3 \<and> syscall_error_to_H (current_syscall_error_' (globals t)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some se | Inr irq \<Rightarrow> cintr irq (deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t)) (errstate (s\<lparr>cRootCap_' := deriveCap_ret_C.cap_C (dc_ret_' s), ret__unsigned_' := cap_get_tag (deriveCap_ret_C.cap_C (dc_ret_' s)), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals t)\<rparr>\<rparr>))))))))) \<and> (deriveCap_ret_C.status_C (dc_ret_' s) \<noteq> 0 \<longrightarrow> (\<forall>err. (\<exists>rv'. err = Inl rv' \<and> deriveCap_ret_C.status_C (dc_ret_' s) = 3 \<and> syscall_error_to_H (current_syscall_error_' (globals s)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some rv') \<longrightarrow> (case err of Inl se \<Rightarrow> deriveCap_ret_C.status_C (dc_ret_' s) = 3 \<and> syscall_error_to_H (current_syscall_error_' (globals s)) (lookup_fault_lift (current_lookup_fault_' (globals s))) = Some se | Inr irq \<Rightarrow> cintr irq (deriveCap_ret_C.status_C (dc_ret_' s)) (errstate s))))}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rv'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb; ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b False False () rv') \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[0],rv') \<lbrace>deriveCap_ret_C.status_C \<acute>dc_ret = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<acute>dc_ret) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rvc. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> ?R'24385 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb rvc (cRootCap_' s)}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 7. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 9. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rva. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rvb (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<lbrace>?R24173 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> return () \<lbrace>\<lambda>rvc. invs' and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0))\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rva. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rvb (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> ((\<lambda>a. True) and ?R24173 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned c) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 6. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 8. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b rva rvb\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI {s. \<forall>rva. ccap_relation (if args ! 1 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) (cRootCap_' s) \<longrightarrow> s \<in> {sa. cap_'_update (\<lambda>_. cRootCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (hd extraCaps))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rvb (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rvb (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))\<rbrace>}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>aa. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)))) aa)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva rvb. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; \<not> rvb\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F24165 length' cap' cRootCap vRootCap bufferCap rv a b False False\<^esub> (?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b False (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false)) IF args ! Suc 0 \<noteq> 0 THEN
  \<acute>cRootCap :== CALL updateCapData_'proc(SCAST(32 signed \<rightarrow> 32) false,args ! Suc 0,cRootCap)
FI \<lbrace>ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! 1) (fst (hd extraCaps))) \<acute>cRootCap \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<acute>cRootCap \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>aa. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)))) aa)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rvb. ((=) \<circ> from_bool) rvb (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rvb \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rvb \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> ?R'24167 length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned rvb (ret__unsigned_long_' s))}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 5. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 7. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a. (\<lambda>aa. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> ((\<lambda>a. True) and (invs' and (\<lambda>a. invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)))) aa)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> \<lbrace>(args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool \<^bsup>s\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! 1) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! 1) (fst (hd extraCaps))) \<acute>cRootCap \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<acute>cRootCap \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))\<rbrace>)}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R23039 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False\<rbrace> slotCapLongRunningDelete (capTCBPtr cp + 2 ^ cteSizeBits) \<lbrace>\<lambda>a aa. (\<not> a \<longrightarrow> invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> \<lbrace>(args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool \<^bsup>s\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! 1) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! 1) (fst (hd extraCaps))) \<acute>cRootCap \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<acute>cRootCap \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))\<rbrace>)}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>c. (\<lambda>ca. (c \<longrightarrow> c) \<and> (\<not> c \<longrightarrow> (invs' and ?R23039 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned c and tcb_at' (ret__unsigned && 0xFFFFFE00)) ca)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 4. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 6. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> UNIV) \<and> (\<not> rva \<longrightarrow> sa \<in> \<lbrace>cRootCap = \<acute>cRootCap\<rbrace> \<inter> \<lbrace>(args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool \<^bsup>s\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! 1) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (\<not> args ! Suc 0 \<noteq> 0 \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! 1) (fst (hd extraCaps))) \<acute>cRootCap \<longrightarrow> ccap_relation (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<acute>cRootCap \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr ret__unsigned = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))\<rbrace>)}} \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>aa. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)) \<and> tcb_at' (ret__unsigned && 0xFFFFFE00) a) and tcb_at' (ret__unsigned && 0xFFFFFE00)) aa)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b rva ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; \<not> rva; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) False (SCAST(32 signed \<rightarrow> 32) false) (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) \<lbrace>\<forall>rva. from_bool rva = \<acute>ret__unsigned_long \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData (to_bool \<acute>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>aa. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)) \<and> tcb_at' (ret__unsigned && 0xFFFFFE00) a) and tcb_at' (ret__unsigned && 0xFFFFFE00)) aa)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 3. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {sa. (rva \<longrightarrow> sa \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> sa \<in> {sa. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. sa \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> ?R'23032 length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned rva (ret__unsigned_long_' s) v \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 5. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a. (\<lambda>aa. (a \<longrightarrow> a) \<and> (\<not> a \<longrightarrow> (invs' and (\<lambda>a. (invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0)) \<and> tcb_at' (ret__unsigned && 0xFFFFFE00) a) and tcb_at' (ret__unsigned && 0xFFFFFE00)) aa)) and tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rva \<longrightarrow> s \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> \<lbrace>\<forall>t rvb. from_bool rvb = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rvb \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<lbrace>?R22092 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv\<rbrace> slotCapLongRunningDelete (capTCBPtr cp) \<lbrace>\<lambda>a aa. (\<not> a \<longrightarrow> invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case rv of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case rv of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa\<rbrace>
 2. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rva \<longrightarrow> s \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> \<lbrace>\<forall>t rvb. from_bool rvb = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rvb \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and ?R22092 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap a\<rbrace>, -
 4. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) {s. \<forall>rva. ((=) \<circ> from_bool) rva (ret__unsigned_long_' s) \<longrightarrow> s \<in> {sa. sa\<lparr>ret__int_' := if ret__unsigned_long_' s \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (rva \<longrightarrow> s \<in> {s'. \<forall>rv. s' \<in> UNIV \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>}) \<and> (\<not> rva \<longrightarrow> s \<in> {s. \<forall>v v'. v = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((v && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp + 2 ^ cteSizeBits)\<rbrace>} \<inter> \<lbrace>\<forall>t rvb. from_bool rvb = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rvb \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rvb. ccap_relation rvb (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rvb \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData rva (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr v = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})}} \<inter> \<lbrace>nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>}
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and (\<lambda>aa. (invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case a of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case a of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa)\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>length' cap' cRootCap vRootCap bufferCap rv a b ret__unsigned. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; ccap_relation (fst (extraCaps ! 2)) bufferCap; case rv of None \<Rightarrow> args ! 3 = 0 \<and> b = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp a \<and> args ! 3 \<noteq> 0 \<and> b = cte_Ptr sl; ret__unsigned = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'22085 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap rv (a, b) a b (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap'))) \<acute>ret__unsigned_long :== CALL slotCapLongRunningDelete_'proc(cte_Ptr ((cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) \<lbrace>\<forall>rva. from_bool rva = \<acute>ret__unsigned_long \<longrightarrow> (rva \<longrightarrow> \<acute>ret__unsigned_long \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rva \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rva \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> b = cte_Ptr (case rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap a) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace>
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and (\<lambda>aa. (invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case a of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case a of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa)\<rbrace>, -
 3. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> ?R'22085 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap (theRight v) rv'dc (fst rv'dc) (snd rv'dc) va \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a. invs' and (\<lambda>aa. (invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case a of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case a of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa)\<rbrace>, -
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> \<lbrace>\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>?R19826 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> if args ! Suc (Suc (Suc 0)) = 0 then returnOk None else doE rv <- injection_handler Inl (global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))));
rva <- injection_handler Inl (checkValidIPCBuffer (args ! Suc (Suc (Suc 0))) rv);
returnOk (Some (rv, snd (extraCaps ! Suc (Suc 0))))
odE \<lbrace>\<lambda>a aa. invs' aa \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> valid_tcb_state' Structures_H.thread_state.Restart aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread aa \<and> thread \<noteq> ksIdleThread aa \<and> st_tcb_at' runnable' thread aa \<and> sch_act_simple aa \<and> invs' aa \<and> sch_act_simple aa \<and> tcb_at' (capTCBPtr cp) aa \<and> ex_nonz_cap_to' (capTCBPtr cp) aa \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) aa \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) aa \<and> (case a of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) aa \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case a of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot aa \<and> (case a of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) aa\<rbrace>, -
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> \<lbrace>\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and ?R19826 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); args ! Suc (Suc (Suc 0)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'27249 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))) \<lbrace>\<lambda>rv s. isArchObjectCap rv \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) s \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) s \<and> (case Some (rv, snd (extraCaps ! Suc (Suc 0))) of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) s \<and> (case Some (rv, snd (extraCaps ! Suc (Suc 0))) of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) s \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case Some (rv, snd (extraCaps ! Suc (Suc 0))) of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> (case Some (rv, snd (extraCaps ! Suc (Suc 0))) of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s\<rbrace>, -
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> \<lbrace>\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> ?P'27249 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2); args ! Suc (Suc (Suc 0)) \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?P'27249 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2))\<rbrace> global.deriveCap (snd (extraCaps ! Suc (Suc 0))) (fst (extraCaps ! Suc (Suc 0))) \<lbrace>\<lambda>rv s. isArchObjectCap rv \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) s \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) s \<and> valid_cap' rv s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s\<rbrace>, -
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> \<lbrace>\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> ?P'27249 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) IF args ! 3 = 0 THEN
  \<acute>bufferSlot :== NULL
ELSE
  \<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI
FI (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. {s. \<forall>va v'. va = cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift (cap_' (cap_'_update (\<lambda>_. cap') s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr ((va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)))) s \<in> UNIV \<inter> \<lbrace>\<acute>slot = cte_Ptr (capTCBPtr cp)\<rbrace>} \<inter> \<lbrace>\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (va && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr va = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries\<rbrace> \<inter> \<lbrace>Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (va && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs)\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap') s)) = SCAST(32 signed \<rightarrow> 32) cap_thread_cap})),UNIV
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap\<^esub> (?R'19820 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) Cond (if args ! 3 = 0 then UNIV else {}) (\<acute>bufferSlot :== NULL) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI) (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. \<lbrace>(cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs))\<rbrace> \<inter> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}))),UNIV
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rvf. ccap_relation rvf (bufferCap_' s) \<longrightarrow> s \<in> {sa. rvf = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rvf \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> ?R'19820 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap rvf (bufferCap_' s)}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap\<^esub> (?P'27384 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap) Cond (if args ! 3 = 0 then UNIV else {}) (\<acute>bufferSlot :== NULL) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI) (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. \<lbrace>(cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs))\<rbrace> \<inter> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}))),UNIV
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = args ! 3 \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<subseteq> ?P'27384 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F19818 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap\<^esub> (?P'27384 length' cap' (args ! 0) (args ! Suc 0) (args ! 2) (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap (fst (extraCaps ! 2)) bufferCap) Cond (if args ! 3 = 0 then UNIV else {}) (\<acute>bufferSlot :== NULL) (\<acute>dc_ret :== CALL deriveCap_'proc(excaprefs_C extraCaps'.[2],bufferCap);;
IF deriveCap_ret_C.status_C \<acute>dc_ret \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. deriveCap_ret_C.status_C (dc_ret_' s))
FI;;
\<acute>bufferCap :== deriveCap_ret_C.cap_C \<acute>dc_ret;;
\<acute>e :== CALL checkValidIPCBuffer_'proc(args ! 3,\<acute>bufferCap);;
IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI) (ccHoarePost (inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> args ! 3 = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> args ! 3 \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. \<lbrace>(cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) (args ! Suc 0) cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs))\<rbrace> \<inter> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}))),UNIV
 2. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = args ! 3 \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<subseteq> ?P'27384 length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap rve vRootCap rvf bufferCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0); ccap_relation (fst (extraCaps ! Suc 0)) vRootCap; rve = fst (extraCaps ! Suc 0); ccap_relation (fst (extraCaps ! 2)) bufferCap; rvf = fst (extraCaps ! 2)\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = args ! 3 \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<subseteq> {s. (s \<in> (if bufferAddr = 0 then UNIV else {}) \<longrightarrow> bufferSlot_'_update (\<lambda>_. NULL) s \<in> ccHoarePost (inr_rrel (\<lambda>v a. case a of (cp', sl') \<Rightarrow> case v of None \<Rightarrow> bufferAddr = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> bufferAddr \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. \<lbrace>(cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs))\<rbrace> \<inter> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {}))) \<and> (s \<notin> (if bufferAddr = 0 then UNIV else {}) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> e_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (s\<lparr>dc_ret_' := ret__struct_deriveCap_ret_C_' t, bufferCap_' := deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), globals := globals s\<lparr>current_syscall_error_' := current_syscall_error_' (globals ta)\<rparr>\<rparr>) \<in> ccHoarePost (inr_rrel (\<lambda>v a. case a of (cp', sl') \<Rightarrow> case v of None \<Rightarrow> bufferAddr = 0 \<and> sl' = NULL | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> bufferAddr \<noteq> 0 \<and> sl' = cte_Ptr sl)) (\<lambda>s. (bufferCap_' s, bufferSlot_' s)) (\<lambda>v rv'dc. \<lbrace>(cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (rv \<longrightarrow> \<^bsup>t\<^esup>ret__unsigned_long \<noteq> 0) \<and> (\<not> rv \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rv. from_bool rv = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> (\<not> rv \<longrightarrow> cRootCap = \<acute>cRootCap \<and> (cRootData \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap cRootCap \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool \<^bsup>t\<^esup>ret__unsigned_long) cRootData cap) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False cRootData (fst (hd extraCaps))) \<^bsup>ta\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (cRootData = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) \<acute>cRootCap \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isCNodeCap rv \<longrightarrow> vRootCap = \<acute>vRootCap \<and> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap vRootCap \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) rve) \<^bsup>t\<^esup>ret__struct_cap_C \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> ccap_relation rve \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C) \<longrightarrow> isValidVTableRoot rv \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> faultEP = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> snd rv'dc = cte_Ptr (case theRight v of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight v of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (fst rv'dc)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd \<acute>t_hrs))\<rbrace> \<inter> (if cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap then UNIV else {})))))}
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) tcbBlockSizeBits; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> sl' = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> sl' = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' ta \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>tb. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' ta)) (args ! Suc 0) cap) (ret__struct_cap_C_' tb) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' tb) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) tcbBlockSizeBits; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 \<and> (length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps)] = NULL)\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> sl' = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> sl' = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' ta \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>tb. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' ta)) (args ! Suc 0) cap) (ret__struct_cap_C_' tb) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' tb) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) tcbBlockSizeBits; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 \<and> (length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps)] = NULL); excaprefs_C extraCaps'.[1] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 1 \<and> (length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps)] = NULL)\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> sl' = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> sl' = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' ta \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>tb. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' ta)) (args ! Suc 0) cap) (ret__struct_cap_C_' tb) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' tb) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) tcbBlockSizeBits; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 \<and> (length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps)] = NULL); excaprefs_C extraCaps'.[1] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 1 \<and> (length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps)] = NULL); excaprefs_C extraCaps'.[2] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 2 \<and> (length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps) < 3 \<longrightarrow> excaprefs_C extraCaps'.[length (map (\<lambda>(cp, y). cte_Ptr y) extraCaps)] = NULL)\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> sl' = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' t \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>t rva. from_bool rva = ret__unsigned_long_' t \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' t)) (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> sl' = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbCTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (rva \<longrightarrow> ret__unsigned_long_' ta \<noteq> 0) \<and> (\<not> rva \<longrightarrow> (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) + SCAST(32 signed \<rightarrow> 32) Kernel_C.tcbVTable * word_of_nat (size_of TYPE(cte_C)) = capTCBPtr cp + 2 ^ cteSizeBits \<and> (\<forall>ta rva. from_bool rva = ret__unsigned_long_' ta \<longrightarrow> (\<not> rva \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>tb. ccap_relation (global.updateCapData (to_bool (ret__unsigned_long_' ta)) (args ! Suc 0) cap) (ret__struct_cap_C_' tb) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' tb) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> SCAST(32 signed \<rightarrow> 32) ThreadState_Restart && mask (Suc (Suc (Suc (Suc 0)))) = SCAST(32 signed \<rightarrow> 32) ThreadState_Restart \<and> tcb_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap')) = tcb_ptr_to_ctcb_ptr (capTCBPtr cp) \<and> args ! 0 = hd args \<and> excaprefs_C extraCaps'.[0] = cte_Ptr (snd (hd extraCaps)) \<and> excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries) \<and> nat (sint Kernel_C.tcbVTable) \<le> unat tcbCNodeEntries \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> nat (sint Kernel_C.tcbCTable) \<le> unat tcbCNodeEntries) \<and> (Kernel_C.tcbCTable = 0 \<or> array_assertion (cte_Ptr (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00)) (nat (sint Kernel_C.tcbCTable)) (hrs_htd (t_hrs_' (globals x)))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0; excaprefs_C extraCaps'.[Suc 0] = (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x); excaprefs_C extraCaps'.[2] = (case extraCaps ! 2 of (cp, x) \<Rightarrow> cte_Ptr x)\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> sl' = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> ret__unsigned_long_' t = 0 \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> ret__unsigned_long_' t = 0 \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> sl' = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (\<forall>ta. (\<exists>rv. from_bool rv = ret__unsigned_long_' ta) \<longrightarrow> ret__unsigned_long_' ta = 0 \<longrightarrow> (\<forall>ta. (\<exists>rv. from_bool rv = ret__unsigned_long_' ta) \<longrightarrow> ret__unsigned_long_' ta = 0 \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0; excaprefs_C extraCaps'.[Suc 0] = (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x); excaprefs_C extraCaps'.[2] = (case extraCaps ! 2 of (cp, x) \<Rightarrow> cte_Ptr x); args \<noteq> [] \<and> extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> sl' = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> ret__unsigned_long_' t = 0 \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> ret__unsigned_long_' t = 0 \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' t) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v (cp', sl'). case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp cp' \<and> sl' = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (\<forall>ta. (\<exists>rv. from_bool rv = ret__unsigned_long_' ta) \<longrightarrow> ret__unsigned_long_' ta = 0 \<longrightarrow> (\<forall>ta. (\<exists>rv. from_bool rv = ret__unsigned_long_' ta) \<longrightarrow> ret__unsigned_long_' ta = 0 \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) (ret__struct_cap_C_' ta) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> ccap_relation (fst (hd extraCaps)) (cRootCap_' x) \<longrightarrow> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> args ! 0 = hd args \<and> map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0 = cte_Ptr (snd (hd extraCaps)) \<and> (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x) = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<and> SCAST(32 signed \<rightarrow> 32) (thread_control_update_space || thread_control_update_ipc_buffer) = SCAST(32 signed \<rightarrow> 32) thread_control_update_ipc_buffer || SCAST(32 signed \<rightarrow> 32) thread_control_update_space \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap))))))) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap) \<and> cap_get_tag cap' = SCAST(32 signed \<rightarrow> 32) cap_thread_cap)))
 2. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0; excaprefs_C extraCaps'.[Suc 0] = (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x); excaprefs_C extraCaps'.[2] = (case extraCaps ! 2 of (cp, x) \<Rightarrow> cte_Ptr x)\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> extraCaps \<noteq> []
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)); excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)); excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))); args \<noteq> [] \<and> extraCaps \<noteq> []\<rbrakk> \<Longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v p. case v of None \<Rightarrow> snd p = NULL | Some x2 \<Rightarrow> False) rv (bufferCap_' x, NULL) \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> ret__unsigned_long_' t = 0 \<longrightarrow> (\<forall>t. (\<exists>rv. from_bool rv = ret__unsigned_long_' t) \<longrightarrow> ret__unsigned_long_' t = 0 \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (extraCaps ! 0))) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x))))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)))))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x))))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) = 0 \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (bufferCap_' x)))))))))))) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<longrightarrow> (\<forall>rv. inr_rrel (\<lambda>v p. case v of None \<Rightarrow> False | Some (cp, sl) \<Rightarrow> ccap_relation cp (fst p) \<and> snd p = cte_Ptr sl) rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t), bufferSlot_' x) \<longrightarrow> (\<forall>ta. (\<exists>rv. from_bool rv = ret__unsigned_long_' ta) \<longrightarrow> ret__unsigned_long_' ta = 0 \<longrightarrow> (\<forall>ta. (\<exists>rv. from_bool rv = ret__unsigned_long_' ta) \<longrightarrow> ret__unsigned_long_' ta = 0 \<longrightarrow> (args ! Suc 0 \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (extraCaps ! 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)))))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))))))))))) \<and> (args ! Suc 0 = 0 \<longrightarrow> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isCNodeCap rva \<longrightarrow> (args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x) \<and> (\<forall>ta. ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) cap) (ret__struct_cap_C_' ta) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) (ret__struct_cap_C_' ta) \<longrightarrow> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)))))))) \<and> (args ! Suc (Suc 0) = 0 \<longrightarrow> (\<forall>ta. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' ta) = 0 \<longrightarrow> (\<forall>rva. ccap_relation rva (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' ta)) \<longrightarrow> isValidVTableRoot rva \<longrightarrow> bufferSlot_' x = cte_Ptr (case theRight rv of None \<Rightarrow> 0 | Some (cap, slot) \<Rightarrow> slot) \<and> (case theRight rv of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> ccap_relation cap (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))))))))))))))
 2. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0; excaprefs_C extraCaps'.[Suc 0] = (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x); excaprefs_C extraCaps'.[2] = (case extraCaps ! 2 of (cp, x) \<Rightarrow> cte_Ptr x)\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> extraCaps \<noteq> []
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>length' cap' bufferCap x t ta a b tb rva tc rvb. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>p. cte_Ptr (snd p)) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0)); excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)); excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))); args \<noteq> []; extraCaps \<noteq> []; args ! Suc (Suc (Suc 0)) \<noteq> 0; deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; ret__unsigned_long_' ta = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; from_bool rva = 0; ret__unsigned_long_' tb = 0; from_bool rvb = 0; ret__unsigned_long_' tc = 0; args ! Suc 0 \<noteq> 0; ccap_relation a (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)); bufferSlot_' x = cte_Ptr b\<rbrakk> \<Longrightarrow> \<exists>cap. ccap_relation cap (cRootCap_' x) \<and> (\<forall>t. ccap_relation (global.updateCapData False (args ! Suc 0) cap) (ret__struct_cap_C_' t) \<longrightarrow> ccap_relation (global.updateCapData False (args ! Suc 0) (fst (extraCaps ! 0))) (ret__struct_cap_C_' t) \<longrightarrow> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = 0 \<longrightarrow> (\<forall>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t)) \<longrightarrow> isCNodeCap rv \<longrightarrow> args ! Suc (Suc 0) \<noteq> 0 \<longrightarrow> (\<exists>cap. ccap_relation cap (vRootCap_' x)))))
 2. \<And>length' cap' bufferCap x. \<lbrakk>interpret_excaps extraCaps' = map (\<lambda>(cp, y). cte_Ptr y) extraCaps; unat length' = length args; ccap_relation cp cap'; Suc (Suc (Suc (Suc 0))) \<le> length args; Suc (Suc (Suc 0)) \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) (cRootCap_' x); ccap_relation (fst (extraCaps ! Suc 0)) (vRootCap_' x); ccap_relation (fst (extraCaps ! Suc (Suc 0))) bufferCap; bufferAddr_' x = args ! Suc (Suc (Suc 0)); isThreadCap cp; is_aligned (capTCBPtr cp) 9; ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr thread; excaprefs_C extraCaps'.[0] = map (\<lambda>(cp, y). cte_Ptr y) extraCaps ! 0; excaprefs_C extraCaps'.[Suc 0] = (case extraCaps ! Suc 0 of (cp, x) \<Rightarrow> cte_Ptr x); excaprefs_C extraCaps'.[2] = (case extraCaps ! 2 of (cp, x) \<Rightarrow> cte_Ptr x)\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> extraCaps \<noteq> []
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 9. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> ((\<lambda>_. True) and (\<lambda>s. args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) and (\<lambda>s. args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>a. True \<and> invs' a \<and> bufferAddr \<noteq> 0)) s) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> valid_cap' (fst a)) a \<and> (case None of None \<Rightarrow> \<lambda>a. True | Some a \<Rightarrow> cte_wp_at' (\<lambda>_. True) (snd a)) a \<and> is_aligned (args ! Suc (Suc (Suc 0))) msg_align_bits \<and> (case None of None \<Rightarrow> True | Some x \<Rightarrow> isArchObjectCap (fst x)) \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> (case None of None \<Rightarrow> True | Some (cap, slot) \<Rightarrow> slot \<noteq> 0) \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> True \<and> True \<and> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (if cRootData = 0 then fst (hd extraCaps) else global.updateCapData False cRootData (fst (hd extraCaps))) a \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then rve else global.updateCapData False (args ! Suc (Suc 0)) rve) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a))) s\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>length' cap' cRootCap vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>rvf s. rvf = fst (extraCaps ! 2) \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) s \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (if args ! Suc 0 = 0 then fst (hd extraCaps) else global.updateCapData False (args ! Suc 0) (fst (hd extraCaps))) s \<and> valid_cap' (if args ! Suc (Suc 0) = 0 then fst (extraCaps ! Suc 0) else global.updateCapData False (args ! Suc (Suc 0)) (fst (extraCaps ! Suc 0))) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s)\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>length' cap' cRootCap vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap\<rbrakk> \<Longrightarrow> \<lbrace>?R19520 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0))\<rbrace> getSlotCap (snd (extraCaps ! 2)) \<lbrace>\<lambda>r s. r = fst (extraCaps ! 2) \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s)\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and ?R19520 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 10. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0); ccap_relation rve vRootCap; rve = fst (extraCaps ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (bufferCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 2) \<longrightarrow> sa \<in> {sa. (sa \<in> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> UNIV) \<and> (sa \<notin> \<lbrace>bufferAddr = 0\<rbrace> \<longrightarrow> sa \<in> {sa. cap_'_update (\<lambda>_. bufferCap_' s) (slot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc (Suc 0)]) sa) \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>slot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>} \<inter> \<lbrace>\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0)))\<rbrace>)} \<inter> \<lbrace>\<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> ccap_relation cp cap' \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}}
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> bufferAddr \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' rve a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' rve a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>length' cap' cRootCap vRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; ccap_relation (fst (extraCaps ! 0)) cRootCap; ccap_relation (fst (extraCaps ! Suc 0)) vRootCap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19517 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap (fst (extraCaps ! Suc 0)) vRootCap) \<acute>bufferCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C''])) \<lbrace>ccap_relation (fst (extraCaps ! 2)) \<acute>bufferCap \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = vRootCap \<and> \<acute>bufferAddr = args ! 3 \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> bufferAddr \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' rve a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' rve a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rve. ccap_relation rve (vRootCap_' s) \<longrightarrow> s \<in> {sa. rve = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> ?R'19517 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap rve (vRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 9. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd\<rbrace> getSlotCap (snd (extraCaps ! 1)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! 1) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> bufferAddr \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' rve a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' rve a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (2 < length extraCaps)) s\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (bufferAddr \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = \<^bsup>s\<^esup>vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>True\<rbrace>}}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<lbrace>?R18410 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0))\<rbrace> getSlotCap (snd (extraCaps ! Suc 0)) \<lbrace>\<lambda>rve s. rve = fst (extraCaps ! Suc 0) \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2])) s) \<and> excaps_in_mem extraCaps (ctes_of s)\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (bufferAddr \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = \<^bsup>s\<^esup>vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>True\<rbrace>}}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and ?R18410 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 8. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 10. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation rvd cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (vRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 1) \<longrightarrow> sa \<in> {sa. bufferSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[2]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (bufferAddr \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> \<acute>bufferSlot = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = cRootCap \<and> \<acute>vRootCap = \<^bsup>s\<^esup>vRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>True\<rbrace>}}}
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) a \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> bufferAddr \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr rvd cRootCap. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3; ccap_relation (fst (extraCaps ! 0)) cRootCap; rvd = fst (extraCaps ! 0)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'18407 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) () (args ! 3) (fst (extraCaps ! 0)) cRootCap) \<acute>vRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C''])) \<lbrace>ccap_relation (fst (extraCaps ! Suc 0)) \<acute>vRootCap \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = cRootCap \<and> \<acute>bufferAddr = args ! 3 \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread)\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) a \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> bufferAddr \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rvd. ccap_relation rvd (cRootCap_' s) \<longrightarrow> s \<in> {sa. rvd = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> ?R'18407 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr rvd (cRootCap_' s) \<inter> \<lbrace>True\<rbrace>}}}
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 7. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 9. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> ((\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 1)) (snd (extraCaps ! 1)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) a \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> bufferAddr = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> bufferAddr \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2])) a) \<and> excaps_in_mem extraCaps (ctes_of a))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (1 < length extraCaps) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0]))) s\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (bufferAddr \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = \<^bsup>s\<^esup>cRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread)\<rbrace> \<inter> \<lbrace>True\<rbrace>}}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>length' cap' faultEP cRootData vRootData bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = args ! Suc 0; vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<lbrace>?R16781 length' cap' () (args ! 0) () (args ! Suc 0) () (args ! 2) ()\<rbrace> getSlotCap (snd (extraCaps ! 0)) \<lbrace>\<lambda>rvd s. rvd = fst (extraCaps ! 0) \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! Suc 0)) (snd (extraCaps ! Suc 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread s \<and> thread \<noteq> ksIdleThread s \<and> st_tcb_at' runnable' thread s \<and> sch_act_simple s \<and> invs' s \<and> sch_act_simple s \<and> tcb_at' (capTCBPtr cp) s \<and> ex_nonz_cap_to' (capTCBPtr cp) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) slot s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2])) s) \<and> excaps_in_mem extraCaps (ctes_of s)) \<and> excaps_in_mem extraCaps (ctes_of s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) s\<rbrace>
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (bufferAddr \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = \<^bsup>s\<^esup>cRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread)\<rbrace> \<inter> \<lbrace>True\<rbrace>}}}
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and ?R16781 length' cap' rv faultEP rva cRootData rvb vRootData rvc and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 4. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 6. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 8. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 10. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2; bufferAddr = args ! 3\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc bufferAddr) \<acute>cRootCap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[0]\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cRootCap_' s) \<longrightarrow> s \<in> {sa. rv = fst (extraCaps ! 0) \<longrightarrow> sa \<in> {sa. vRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[Suc 0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[Suc 0] = cte_Ptr (snd (extraCaps ! 1))\<rbrace> \<inter> \<lbrace>ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(excaprefs_C extraCaps'.[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (bufferAddr \<noteq> 0 \<longrightarrow> excaprefs_C extraCaps'.[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C \<^bsup>t\<^esup>ret__struct_deriveCap_ret_C)) \<longrightarrow> excaprefs_C extraCaps'.[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> \<acute>cRootCap = \<^bsup>s\<^esup>cRootCap \<and> \<acute>bufferAddr = bufferAddr \<and> isThreadCap cp \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> \<acute>ksCurThread = tcb_ptr_to_ctcb_ptr thread)\<rbrace> \<inter> \<lbrace>True\<rbrace>}}}
 2. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<lbrace>?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace> return () \<lbrace>\<lambda>rvc. (\<lambda>s. cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! Suc 0)) (snd (extraCaps ! Suc 0)) a \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) a \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> invs' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Restart a \<and> sch_act_wf (ksSchedulerAction a) a \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) thread a \<and> thread \<noteq> ksIdleThread a \<and> st_tcb_at' runnable' thread a \<and> sch_act_simple a \<and> invs' a \<and> sch_act_simple a \<and> tcb_at' (capTCBPtr cp) a \<and> ex_nonz_cap_to' (capTCBPtr cp) a \<and> valid_cap' (fst (hd extraCaps)) a \<and> valid_cap' (fst (extraCaps ! Suc 0)) a \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) a \<and> cte_wp_at' (\<lambda>_. True) slot a \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap') && 0xFFFFFE00) a) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[2])) a) \<and> excaps_in_mem extraCaps (ctes_of a)) \<and> excaps_in_mem extraCaps (ctes_of a) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[Suc 0])) a) and cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C extraCaps'.[0]))) s) and excaps_in_mem extraCaps \<circ> ctes_of and K (0 < length extraCaps)\<rbrace>
 3. \<And>length' cap' rv faultEP rva cRootData rvb vRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1); vRootData = args ! 2\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'14708 length' cap' rv faultEP rva cRootData rvb vRootData) \<acute>bufferAddr :== CALL getSyscallArg_'proc(3,option_to_ptr buffer) {s. \<forall>rvc. bufferAddr_' s = args ! 3 \<longrightarrow> s \<in> {sa. cRootSlot_'_update (\<lambda>_. excaprefs_C extraCaps'.[0]) sa \<in> \<lbrace>excaprefs_C extraCaps'.[0] = cte_Ptr (snd (extraCaps ! 0))\<rbrace> \<inter> ?R'16778 length' cap' rv faultEP rva cRootData rvb vRootData rvc (bufferAddr_' s) \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<lbrace>?R13639 length' cap' rv faultEP rva\<rbrace> return () \<lbrace>\<lambda>rvb. sysargs_rel args buffer and sysargs_rel_n args buffer 3 and ?R14710 length' cap' rv faultEP rva cRootData rvb\<rbrace>
 5. \<And>length' cap' rv faultEP rva cRootData. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0; cRootData = UCAST(32 \<rightarrow> 32) (args ! 1)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'13637 length' cap' rv faultEP rva cRootData) \<acute>vRootData :== CALL getSyscallArg_'proc(2,option_to_ptr buffer) {s. \<forall>rvb. vRootData_' s = args ! 2 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 3) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 3\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'14708 length' cap' rv faultEP rva cRootData rvb (vRootData_' s)}
 6. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<lbrace>?R12542 length' cap' rv\<rbrace> return () \<lbrace>\<lambda>rva. sysargs_rel args buffer and sysargs_rel_n args buffer 2 and ?R13639 length' cap' rv faultEP rva\<rbrace>
 7. \<And>length' cap' rv faultEP. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps; faultEP = args ! 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'12540 length' cap' rv faultEP) \<acute>cRootData :== CALL getSyscallArg_'proc(1,option_to_ptr buffer) {s. \<forall>rva. cRootData_' s = UCAST(32 \<rightarrow> 32) (args ! 1) \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 2) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 2\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'13637 length' cap' rv faultEP rva (cRootData_' s)}
 8. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<lbrace>?R11370 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap'\<rbrace> return () \<lbrace>\<lambda>a. sysargs_rel args buffer and sysargs_rel_n args buffer 1 and ?R12542 length' cap' a\<rbrace>
 9. \<And>length' cap'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; unat length' = length args; ccap_relation cp cap'; 4 \<le> length args; 3 \<le> length extraCaps\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11365 (option_to_ptr buffer) extraCaps' (cte_Ptr slot) length' cap') \<acute>faultEP :== CALL getSyscallArg_'proc(0,option_to_ptr buffer) {s. \<forall>rv. faultEP_' s = args ! 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. option_to_ptr buffer) (i_'_update (\<lambda>_. 1) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 1\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = option_to_ptr buffer\<rbrace>} \<inter> ?R'12540 length' cap' rv (faultEP_' s)}
 10. \<And>buffera current_extra_caps slota length___unsigned_long cap s s'. \<lbrakk>interpret_excaps extraCaps' = excaps_map extraCaps; buffera = option_to_ptr buffer; current_extra_caps = extraCaps'; slota = cte_Ptr slot; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; (invs' and sch_act_simple and (\<lambda>s. ksCurThread s = thread) and ct_active' and excaps_in_mem extraCaps \<circ> ctes_of and valid_cap' cp and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>y. isThreadCap cp) and ex_nonz_cap_to' (capTCBPtr cp) and tcb_at' (capTCBPtr cp) and (\<lambda>s. \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s) and (\<lambda>s. \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s) and sysargs_rel args buffer) s; s' \<in> UNIV \<inter> \<lbrace>\<acute>current_extra_caps = current_extra_caps\<rbrace>\<rbrakk> \<Longrightarrow> ((length___unsigned_long < 4 \<longrightarrow> True) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> True) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> (sysargs_rel args buffer and sysargs_rel_n args buffer 0 and ?R11370 buffera current_extra_caps slota length___unsigned_long cap) s))))) \<and> s' \<in> {s. s\<lparr>ret__int_' := if length___unsigned_long < 4 then 1 else 0\<rparr> \<in> {s. (length___unsigned_long < 4 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0\<rparr> \<in> {s. ((if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if extraCaps = [] \<and> idButNot excaprefs_C current_extra_caps.[0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> Suc 0 \<and> idButNot excaprefs_C current_extra_caps.[Suc 0] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0\<rparr> \<in> {s. ((if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> (if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C current_extra_caps.[2] = NULL then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. ipc_buffer_'_update (\<lambda>_. buffera) (i_'_update (\<lambda>_. 0) s) \<in> UNIV \<inter> \<lbrace>unat \<acute>i = 0\<rbrace> \<inter> \<lbrace>\<acute>ipc_buffer = buffera\<rbrace>} \<inter> ?R'11365 buffera current_extra_caps slota length___unsigned_long cap)}})}})}})}} proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (\<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! Suc 0)) (snd (extraCaps ! Suc 0)) s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> extraCaps \<noteq> []) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> cRootSlot_'_update (\<lambda>_. excaprefs_C (current_extra_caps_' (globals s')).[0]) (bufferAddr_'_update (\<lambda>_. args ! 3) (vRootData_'_update (\<lambda>_. args ! 2) (cRootData_'_update (\<lambda>_. args ! Suc 0) (faultEP_'_update (\<lambda>_. args ! 0) (s'\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] = NULL then 1 else 0\<rparr>))))) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> vRootSlot_'_update (\<lambda>_. excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]) (cRootCap_'_update (\<lambda>_. h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) (cRootSlot_'_update (\<lambda>_. excaprefs_C (current_extra_caps_' (globals s')).[0]) (bufferAddr_'_update (\<lambda>_. args ! 3) (vRootData_'_update (\<lambda>_. args ! 2) (cRootData_'_update (\<lambda>_. args ! Suc 0) (faultEP_'_update (\<lambda>_. args ! 0) (s'\<lparr>ret__int_' := if length (excaps_map extraCaps) \<le> 2 \<and> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] = NULL then 1 else 0\<rparr>))))))) \<in> (if excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) then UNIV else {}) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s))))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> (\<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! Suc 0)) (snd (extraCaps ! Suc 0)) s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> extraCaps \<noteq> []) \<and> (\<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s))))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 0)) (snd (extraCaps ! 0)) s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! Suc 0)) (snd (extraCaps ! Suc 0)) s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = fst (extraCaps ! 2)) (snd (extraCaps ! 2)) s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> valid_cap' (fst (hd extraCaps)) s \<and> valid_cap' (fst (extraCaps ! Suc 0)) s \<and> valid_cap' (fst (extraCaps ! Suc (Suc 0))) s \<and> cte_wp_at' (\<lambda>_. True) (snd (extraCaps ! Suc (Suc 0))) s \<and> snd (extraCaps ! Suc (Suc 0)) \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s) \<and> extraCaps \<noteq> []
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> sysargs_rel_n args buffer 0 s \<and> sysargs_rel_n args buffer (Suc 0) s \<and> sysargs_rel_n args buffer 2 s \<and> sysargs_rel_n args buffer 3 s \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = aa) ba s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = ab) bb s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> bb \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length args < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = aa) ba s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = ab) bb s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> bb \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length args < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; valid_mdb' s\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = aa) ba s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = ab) bb s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> bb \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length args < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; valid_mdb' s; tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) s\<rbrakk> \<Longrightarrow> args \<noteq> [] \<and> (cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = aa) ba s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = ab) bb s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> bb \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length args < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; valid_mdb' s; tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = aa) ba s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = ab) bb s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> bb \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' a b aa ba ab bb ys. \<lbrakk>unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length args < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; valid_mdb' s; tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) s; \<forall>n<length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys). excaprefs_C (current_extra_caps_' (globals s')).[n] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! n \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL)\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = a) b s \<longrightarrow> (cte_wp_at' (\<lambda>cte. cteCap cte = aa) ba s \<longrightarrow> cte_wp_at' (\<lambda>cte. cteCap cte = ab) bb s \<longrightarrow> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> args ! 3 = 0) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> args ! 3 \<noteq> 0) \<and> (args ! Suc (Suc (Suc 0)) = 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> (args ! Suc (Suc (Suc 0)) \<noteq> 0 \<longrightarrow> tcb_at' (ksCurThread s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Restart s \<and> sch_act_wf (ksSchedulerAction s) s \<and> st_tcb_at' (\<lambda>st'. tcb_st_refs_of' st' = {} \<and> st' \<noteq> Structures_H.thread_state.Inactive \<and> st' \<noteq> Structures_H.thread_state.IdleThreadState) (ksCurThread s) s \<and> st_tcb_at' runnable' (ksCurThread s) s \<and> bb \<noteq> 0 \<and> tcb_at' (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[2])) s) \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[Suc 0])) s \<and> cte_wp_at' (\<lambda>_. True) (ptr_val (excaprefs_C (current_extra_caps_' (globals s')).[0])) s
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long cap s s' b ba bb ys ko cte koa ctea cteb ctec kob obj obja objb. \<lbrakk>unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; excaps_in_mem ((cteCap ctea, b) # (cteCap cteb, ba) # (cteCap ctec, bb) # ys) (ctes_of s); valid_cap' cp s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length args < Suc (Suc (Suc (Suc 0))); extraCaps = (cteCap ctea, b) # (cteCap cteb, ba) # (cteCap ctec, bb) # ys; valid_cap' (cteCap ctea) s; ex_cte_cap_wp_to' isCNodeCap b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' (cteCap cteb) s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' (cteCap ctec) s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> (\<exists>cte. ctes_of s (snd v) = Some cte); valid_mdb' s; \<forall>n<Suc (Suc (Suc (length ys))). excaprefs_C (current_extra_caps_' (globals s')).[n] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! n; ctes_of s slot = Some cte; ksPSpace s (ksCurThread s) = Some ko; ksPSpace s (capTCBPtr cp) = Some koa; ksPSpace s (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) = Some kob; is_aligned (ksCurThread s) (objBitsKO ko); is_aligned (capTCBPtr cp) (objBitsKO koa); is_aligned (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) (objBitsKO kob); fst (projectKO ko s) = {(obj, s)}; ps_clear (capTCBPtr cp) (objBitsKO koa) s; fst (projectKO koa s) = {(obja, s)}; ps_clear (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && ~~ mask tcbBlockSizeBits) (objBitsKO kob) s; fst (projectKO kob s) = {(objb, s)}; active' (tcbState obj); ps_clear (ksCurThread s) (objBitsKO ko) s; ctes_of s b = Some ctea; ctes_of s ba = Some cteb; ctes_of s bb = Some ctec\<rbrakk> \<Longrightarrow> (case tcbState obj of Structures_H.thread_state.BlockedOnReceive x a \<Rightarrow> {(x, TCBBlockedRecv)} | Structures_H.thread_state.BlockedOnNotification x \<Rightarrow> {(x, TCBSignal)} | Structures_H.thread_state.BlockedOnSend x a b c d \<Rightarrow> {(x, TCBBlockedSend)} | _ \<Rightarrow> {}) = {} \<and> tcbState obj \<noteq> Structures_H.thread_state.Inactive \<and> tcbState obj \<noteq> Structures_H.thread_state.IdleThreadState \<and> runnable' (tcbState obj) \<and> (\<exists>ko. ksPSpace s (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) = Some ko \<and> is_aligned (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) (objBitsKO ko) \<and> (\<exists>obj. fst (projectKO ko s) = {(obj, s)}) \<and> ps_clear (cap_thread_cap_CL.capTCBPtr_CL (cap_thread_cap_lift cap) && 0xFFFFFE00) (objBitsKO ko) s)
 2. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s'. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = excaps_map extraCaps; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem extraCaps (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; \<forall>v\<in>set extraCaps. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; \<forall>v\<in>set extraCaps. ex_cte_cap_wp_to' isCNodeCap (snd v) s; sysargs_rel args buffer s\<rbrakk> \<Longrightarrow> \<not> length___unsigned_long < 4 \<longrightarrow> (extraCaps = [] \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> Suc 0 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] \<noteq> NULL) \<longrightarrow> (length (excaps_map extraCaps) \<le> 2 \<longrightarrow> idButNot excaprefs_C (current_extra_caps_' (globals s')).[2] \<noteq> NULL) \<longrightarrow> (\<exists>t. ret__unsigned_long_' t = args ! 0) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr (snd (extraCaps ! 0)) \<and> (ccap_relation (fst (extraCaps ! 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr (snd (extraCaps ! Suc 0)) \<and> (ccap_relation (fst (extraCaps ! Suc 0)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! 2)) \<and> (ccap_relation (fst (extraCaps ! 2)) (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))) \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr (snd (extraCaps ! Suc (Suc 0))))) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb \<and> (ccap_relation ab (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr bb \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb)) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 0 \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb \<and> (ccap_relation ab (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr bb \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb)) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 0 \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL); excaprefs_C (current_extra_caps_' (globals s')).[1] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 1 \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb \<and> (ccap_relation ab (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr bb \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb)) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 0 \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL); excaprefs_C (current_extra_caps_' (globals s')).[1] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 1 \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL); excaprefs_C (current_extra_caps_' (globals s')).[2] = (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) ! 2 \<and> (length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys) < 3 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[length (cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys)] = NULL)\<rbrakk> \<Longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b \<and> (ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba \<and> (ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[Suc 0]\<rightarrow>[''cap_C'']))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb \<and> (ccap_relation ab (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(excaprefs_C (current_extra_caps_' (globals s')).[2]\<rightarrow>[''cap_C'']))) \<longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr bb \<and> (\<forall>t. deriveCap_ret_C.status_C (ret__struct_deriveCap_ret_C_' t) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<exists>rv. ccap_relation rv (deriveCap_ret_C.cap_C (ret__struct_deriveCap_ret_C_' t))) \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb)) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits \<and> ksCurThread_' (globals s') = tcb_ptr_to_ctcb_ptr (ksCurThread s)))) proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))); ccap_relation ab (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr bb\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr bb) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits proof (prove)
goal (1 subgoal):
 1. \<And>length___unsigned_long cap s s' a b t aa ba ab bb ys. \<lbrakk>interpret_excaps (current_extra_caps_' (globals s')) = cte_Ptr b # cte_Ptr ba # cte_Ptr bb # map (\<lambda>(cp, y). cte_Ptr y) ys; unat length___unsigned_long = length args; ccap_relation cp cap; (s, s') \<in> rf_sr; extraCaps' = current_extra_caps_' (globals s'); invs' s; sch_act_simple s; thread = ksCurThread s; ct_active' s; excaps_in_mem ((a, b) # (aa, ba) # (ab, bb) # ys) (ctes_of s); valid_cap' cp s; cte_wp_at' (\<lambda>_. True) slot s; isThreadCap cp; ex_nonz_cap_to' (capTCBPtr cp) s; tcb_at' (capTCBPtr cp) s; sysargs_rel args buffer s; \<not> length___unsigned_long < 4; extraCaps = (a, b) # (aa, ba) # (ab, bb) # ys; ret__unsigned_long_' t = args ! 0; valid_cap' a s; ex_cte_cap_wp_to' isCNodeCap b s; cte_wp_at' (\<lambda>_. True) b s; ex_cte_cap_wp_to' isCNodeCap ba s; valid_cap' aa s; cte_wp_at' (\<lambda>_. True) ba s; ex_cte_cap_wp_to' isCNodeCap bb s; \<forall>v\<in>set ys. ex_cte_cap_wp_to' isCNodeCap (snd v) s; valid_cap' ab s; cte_wp_at' (\<lambda>_. True) bb s; \<forall>v\<in>set ys. valid_cap' (fst v) s \<and> cte_wp_at' (\<lambda>_. True) (snd v) s; excaprefs_C (current_extra_caps_' (globals s')).[0] = cte_Ptr b; excaprefs_C (current_extra_caps_' (globals s')).[Suc 0] = cte_Ptr ba; excaprefs_C (current_extra_caps_' (globals s')).[2] = cte_Ptr bb; ccap_relation a (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr b\<rightarrow>[''cap_C'']))); ccap_relation aa (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr ba\<rightarrow>[''cap_C'']))); ccap_relation ab (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr bb\<rightarrow>[''cap_C'']))); s' \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (ksCurThread s)\<rbrakk> \<Longrightarrow> (args ! 3 \<noteq> 0 \<longrightarrow> excaprefs_C (current_extra_caps_' (globals s')).[Suc (Suc 0)] = cte_Ptr bb) \<and> is_aligned (capTCBPtr cp) tcbBlockSizeBits proof (prove)
goal:
No subgoals!